21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Encoder Sample 8cfbd38855d2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8cfbd38855d2…. Malware family: Trojan.Encoder. Threat score 100/100. 24/27 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","keywords":["Malicious","Trojan.Encoder","malware analysis","sandbox report","threat intelligence","8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29"],"about":{"@type":"SoftwareApplication","name":"svchub.2591.exe","applicationCategory":["peexe","executable"],"identifier":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Encoder","antivirusDetections":{"malicious":24,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T859,Spawned process "svchub.328.exe" with commandline "-w" (UID: 00010384-00003924) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00010506-00003540), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00010509-00003964) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00010842-00003772), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00010843-00003568) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011179-00002520), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011180-00003792) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011516-00002516), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011516-00002608) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011849-00003480), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011849-00002056) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00012183-00003464), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00012183-00003076) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00012520-00004032), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00012520-00000748)23:T859,Spawned process "svchub.328.exe" with commandline "-w" (UID: 00010384-00003924) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00010506-00003540), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00010509-00003964) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00010842-00003772), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00010843-00003568) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011179-00002520), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011180-00003792) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011516-00002516), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011516-00002608) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011849-00003480), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00011849-00002056) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00012183-00003464), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00012183-00003076) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00012520-00004032), Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+ ..." (UID: 00012520-00000748)24:Tab8,"Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impos" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, Indicator: "files are encrypted") "Greetings! There was a significant flaw in the security system of your company. You should be thankful that the flaw was exploited by serious people and not some rookies. They would have damaged all of your data by mistake or for fun. Your files are encrypted with the strongest military algorithms RSA4096 and AES-256. Without our special decoder it is impossible to restore the data. Attempts to restore your data with third party software as Photorec, RannohDecryptor etc. will lead to irreversible destruction of your data. To confirm our honest intentions. Send us 2-3 different random files and you will get them decrypted. It can be from different computers on your network to be sure that our decoder decrypts everything. Sample files we unlock for free (files should not be related to any kind of backups). We exclusively have decryption software for your situation DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. This may lead to the impossibility of recovery of the certain files. To get information on the price of the decoder contact us at: AbbsChevis@protonmail.com, IjuqodiSunovib98@o2.pl The payment has to be made in Bitcoins. The final price depends on how fast you contact us. As soon as we receive the payment you will get the decryption tool and instructions on how to improve your systems security" (Source: README-NOW.txt, Indicator: "files are encrypted") "Your files are encrypted with the strongest military algorithms RSA4096 and AES-256." (Source: README-NOW.txt, Indicator: "files are encrypted")25:T8de,".exe" opened "C:\8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.exe" with delete access "svchub.328.exe" opened "Z:\1553169043275$MAPFAILURE" with delete access "svchub.328.exe" opened "Z:\1553169043275$OK" with delete access "svchub.328.exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab" with delete access "svchub.328.exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "svchub.328.exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab" with delete access "svchub.328.exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access "svchub.328.exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "svchub.328.exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi" with delete access "svchub.328.exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab" with delete access "svchub.328.exe" opened "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi" with delete access "svchub.328.exe" opened "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab" with delete access "svchub.328.exe" opened "C:\Program Files\7-Zip\Lang\be.txt" with delete access "svchub.328.exe" opened "C:\Program Files\7-Zip\Lang\sk.txt" with delete access "svchub.328.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\Tracker\pdf.gif" with delete access "svchub.328.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_ie8.gif" with delete access "svchub.328.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main.css" with delete access "svchub.328.exe" opened "C:\Program Files\AutoIt3\Examples\Helpfile\Extras\Exclamation.png" with delete access "svchub.328.exe" opened "C:\Program Files\AutoIt3\Examples\Helpfile\_NowTime.au3" with delete access "svchub.328.exe" opened "C:\Program Files\Common Files\System\msadc\adcvbs.inc" with delete access26:Tbce,Found string "NtSetInformationFile" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: NTDLL.DLL) Found string "NtQuerySystemInformation" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: NTDLL.DLL) Found string "NtQueryObject" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: NTDLL.DLL) Found string "NtQuerySemaphore" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: NTDLL.DLL) Found string "NtQuerySection" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: NTDLL.DLL) Found string "NtOpenFile" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: NTDLL.DLL) Found string "NtQueryTimerResolution" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: NTDLL.DLL) Found string "SetWaitableTimerEx" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNELBASE.DLL) Found string "CreateSymbolicLinkW" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNEL32.DLL) Found string "GetFileInformationByHandleEx" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNEL32.DLL) Found string "SetFileInformationByHandle" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNELBASE.DLL) Found string "InitOnceExecuteOnce" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNEL32.DLL) Found string "CreateEventExW" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNELBASE.DLL) Found string "CreateSemaphoreW" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNEL32.DLL) Found string "CreateSemaphoreExW" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNELBASE.DLL) Found string "CreateThreadpoolTimer" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNELBASE.DLL) Found string "CreateThreadpoolWait" (Source: 8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin, API is part of module: KERNELBASE.DLL)27:T8c7,50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 3924) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 3540) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 3964) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 3772) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 3568) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 2520) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 3792) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 2516) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 2608) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 3480) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 2056) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 3464) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 3076) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 4032) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate) 50/71 Antivirus vendors marked spawned process "svchub.328.exe" (PID: 748) as malicious (classified as "Ransom.LockerGoga" with 70% detection rate)28:T448,".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchub.328.exe" (Handle: 156) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchub.328.exe" (Handle: 156) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchub.328.exe" (Handle: 156) "svchub.328.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchub.328.exe" (Handle: 280) "svchub.328.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchub.328.exe" (Handle: 280) "svchub.328.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchub.328.exe" (Handle: 280) "svchub.328.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchub.328.exe" (Handle: 236) "svchub.328.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchub.328.exe" (Handle: 236) "svchub.328.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svchub.328.exe" (Handle: 236)29:T23bb,Spawned process ".exe" (UID: 00010245-00002888) Spawned process "svchub.328.exe" with commandline "-w" (UID: 00010384-00003924) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl Z:\1553169043275$MAPFAILURE Z:\1553169043275$OK Z:\network.pcapng" (UID: 00010506-00003540) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab" "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab" "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml"" (UID: 00010509-00003964) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml" "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi" "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab" "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi"" (UID: 00010842-00003772) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab" "%PROGRAMFILES%\7-Zip\Lang\be.txt" "%PROGRAMFILES%\7-Zip\Lang\sk.txt" "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\Tracker\pdf.gif"" (UID: 00010843-00003568) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_ie8.gif" "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main.css" "%PROGRAMFILES%\AutoIt3\Examples\Helpfile\Extras\Exclamation.png" "%PROGRAMFILES%\AutoIt3\Examples\Helpfile\_NowTime.au3"" (UID: 00011179-00002520) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "%COMMONPROGRAMFILES%\System\msadc\adcvbs.inc" "%COMMONPROGRAMFILES%\System\msadc\adcjavas.inc" "%COMMONPROGRAMFILES%\System\en-US\wab32res.dll.mui" "%COMMONPROGRAMFILES%\System\ado\msadox28.tlb"" (UID: 00011180-00003792) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "%PROGRAMFILES%\HNC\Shared80\Clipart\CommonClipart\KT_Custom\Custo_10.PNG" "%PROGRAMFILES%\HNC\Shared80\Clipart\CommonClipart\KT_Custom\Custo_09.PNG" "%PROGRAMFILES%\AutoIt3\Examples\Helpfile\_NowDate.au3" "%PROGRAMFILES%\HNC\Shared80\Clipart\CommonClipart\KT_Custom\Custo_08.PNG"" (UID: 00011516-00002516) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "%COMMONPROGRAMFILES%\System\msadc\handsafe.reg" "%COMMONPROGRAMFILES%\System\msadc\handler.reg" "%COMMONPROGRAMFILES%\System\msadc\en-US\msdaremr.dll.mui" "%COMMONPROGRAMFILES%\System\msadc\en-US\msdaprsr.dll.mui"" (UID: 00011516-00002608) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HH02166_.WMF" "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HH02282_.WMF" "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HH02155_.WMF" "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HH02298_.WMF"" (UID: 00011849-00003480) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "%PROGRAMFILES%\HNC\Shared80\HwpTemplate\Doc\enu\Stationery\Staccato Color Letterhead without border.hwt" "%PROGRAMFILES%\HNC\Shared80\Clipart\CommonClipart\KT_Custom\Custo_07.PNG" "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HH01461_.WMF" "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HH01923_.WMF"" (UID: 00011849-00002056) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HM00172_.WMF" "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF" "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0QPGGJBR\hm[1].js" "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0QPGGJBR\HitachiSocialInnovation[8].mp4"" (UID: 00012183-00003464) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HH02313_.WMF" "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HM00005_.WMF" "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF" "%PROGRAMFILES%\Microsoft Office\CLIPART\PUB60COR\HM00114_.WMF"" (UID: 00012183-00003076) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0QPGGJBR\HitachiSocialInnovation[3].mp4" "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0QPGGJBR\HitachiSocialInnovation[2].mp4" "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\OCO9PWXQ\libs[1].js" "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\OCO9PWXQ\leftservices[1].js"" (UID: 00012520-00004032) Spawned process "svchub.328.exe" with commandline "-w -k "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0QPGGJBR\HitachiSocialInnovation[7].mp4" "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0QPGGJBR\HitachiSocialInnovation[6].mp4" "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0QPGGJBR\HitachiSocialInnovation[5].mp4" "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0QPGGJBR\HitachiSocialInnovation[4].mp4"" (UID: 00012520-00000748)2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790332118626,"unified_at":"2026-09-25T10:28:38.626Z","metadata":{"hashes":{"sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","sha1":"f92339e73c7e901c0c852d8e65615cfb588a4ff6","md5":"164f72dfb729ca1e15f99d456b7cf811","sha512":"9fb1314230df3ffec2dc2add2dd2450eddffcb981b0742875b876162318c55921bcd737b18b2bf6157f2a30a7fe69d271ded0db517cfb233e9d37e37b3a66b7f","ssdeep":"24576:Kla7NCRgrdZ3+0qC3iQx+iE89W++aHGX4vju0zU7KwQCBzSyn9RwAoS:KYxSU393kiE8KRXGuV7KwQCBzSQwAoS","ssdeep_chunks":["24576:Kla7NCR","24576:la7NCRg","24576:a7NCRgr","24576:7NCRgrd","24576:NCRgrdZ","24576:CRgrdZ3","24576:RgrdZ3+","24576:grdZ3+0","24576:rdZ3+0q","24576:dZ3+0qC","24576:Z3+0qC3","24576:3+0qC3i","24576:+0qC3iQ","24576:0qC3iQx","24576:qC3iQx+","24576:C3iQx+i","24576:3iQx+iE","24576:iQx+iE8","24576:Qx+iE89","24576:x+iE89W","24576:+iE89W+","24576:iE89W++","24576:E89W++a","24576:89W++aH","24576:9W++aHG","24576:W++aHGX","24576:++aHGX4","24576:+aHGX4v","24576:aHGX4vj","24576:HGX4vju","24576:GX4vju0","24576:X4vju0z","24576:4vju0zU","24576:vju0zU7","24576:ju0zU7K","24576:u0zU7Kw","24576:0zU7KwQ","24576:zU7KwQC","24576:U7KwQCB","24576:7KwQCBz","24576:KwQCBzS","24576:wQCBzSy","24576:QCBzSyn","24576:CBzSyn9","24576:BzSyn9R","24576:zSyn9Rw","24576:Syn9RwA","24576:yn9RwAo","24576:n9RwAoS","49152:Kla7NCR","49152:la7NCRg","49152:a7NCRgr","49152:7NCRgrd","49152:NCRgrdZ","49152:CRgrdZ3","49152:RgrdZ3+","49152:grdZ3+0","49152:rdZ3+0q","49152:dZ3+0qC","49152:Z3+0qC3","49152:3+0qC3i","49152:+0qC3iQ","49152:0qC3iQx","49152:qC3iQx+","49152:C3iQx+i","49152:3iQx+iE","49152:iQx+iE8","49152:Qx+iE89","49152:x+iE89W","49152:+iE89W+","49152:iE89W++","49152:E89W++a","49152:89W++aH","49152:9W++aHG","49152:W++aHGX","49152:++aHGX4","49152:+aHGX4v","49152:aHGX4vj","49152:HGX4vju","49152:GX4vju0","49152:X4vju0z","49152:4vju0zU","49152:vju0zU7","49152:ju0zU7K","49152:u0zU7Kw","49152:0zU7KwQ","49152:zU7KwQC","49152:U7KwQCB","49152:7KwQCBz","49152:KwQCBzS","49152:wQCBzSy","49152:QCBzSyn","49152:CBzSyn9","49152:BzSyn9R","49152:zSyn9Rw","49152:Syn9RwA","49152:yn9RwAo","49152:n9RwAoS","24576:KYxSU39","24576:YxSU393","24576:xSU393k","24576:SU393ki","24576:U393kiE","24576:393kiE8","24576:93kiE8K","24576:3kiE8KR","24576:kiE8KRX","24576:iE8KRXG","24576:E8KRXGu","24576:8KRXGuV","24576:KRXGuV7","24576:RXGuV7K","24576:XGuV7Kw","24576:GuV7KwQ","24576:uV7KwQC","24576:V7KwQCB","24576:wQCBzSQ","24576:QCBzSQw","24576:CBzSQwA","24576:BzSQwAo","24576:zSQwAoS"],"imphash":"9f0af3709985725a166977d6f89a4b0e"},"file_info":{"file_name":"svchub.2591.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1282576,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1548690387000,"last_seen":1687455808000,"last_multi_scan":1687455808000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","crypt","cryptlocker","downloader","genkryptik","kryptik","locker","lockergoga","ransomware","stealer"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":11,"suspicious_count":11,"malicious_count":8,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypren.tpVm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.FileCoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Crypren","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.LockerGaga.ujeuv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.LockerGoga.67BFD52E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Lockergoga-6900590-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.LockerGoga.67BFD52E (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.LockerGoga.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/LockFile.fi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005470f61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Crypren.afbj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.fmmfaf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FFO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.8F9672D2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.8F9672D2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/LockerGoga.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.BNYU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Crypren.Win32.812","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Encoder","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00010245-00002888-53851-2-00EDA99B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010245-00002888-53851-60-00EFA02F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$22","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$23","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: C1:B4:D5:7A:36:E0:B6:85:3D:D3:8E:30:34:ED:F7:D9:9A:8B:73:AD; see report for more information)\n The input sample is signed with a certificate issued by \"CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: B6:9E:75:2B:BE:88:B4:45:82:00:A7:C0:F4:F5:B3:CC:E6:F3:5B:47; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"svchub.328.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"README-NOW.txt\" has type \"ASCII text with CRLF line terminators\"\n \"wipe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"svchub.328.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"svchub.328.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"svchub.328.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"svchub.328.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"AbbsChevis@protonmail.com\"\n Heuristic match: \"IjuqodiSunovib98@o2.pl\"\n Pattern match: \"https://secure.comodo.net/CPS0C\"\n Pattern match: \"crl.comodoca.com/COMODORSACodeSigningCA.crl0t\"\n Pattern match: \"crt.comodoca.com/COMODORSACodeSigningCA.crt0$\"\n Pattern match: \"http://ocsp.comodoca.com0\"\n Pattern match: \"http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q\"\n Pattern match: \"http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$\"\n Heuristic match: \"AbbsChevis@protonmail.com, IjuqodiSunovib98@o2.pl\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"svchub.328.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00010245-00002888-00000105-4798135237\n \"svchub.328.exe\" at 00010384-00003924-00000105-9056075755\n \"svchub.328.exe\" at 00010506-00003540-00000105-13242107974\n \"svchub.328.exe\" at 00010509-00003964-00000105-13130598353\n \"svchub.328.exe\" at 00010842-00003772-00000105-25142857790\n \"svchub.328.exe\" at 00010843-00003568-00000105-25462434046\n \"svchub.328.exe\" at 00011179-00002520-00000105-36943736984\n \"svchub.328.exe\" at 00011180-00003792-00000105-36966937483\n \"svchub.328.exe\" at 00011516-00002516-00000105-47903654094\n \"svchub.328.exe\" at 00011516-00002608-00000105-47924704360\n \"svchub.328.exe\" at 00011849-00003480-00000105-60034853422\n \"svchub.328.exe\" at 00011849-00002056-00000105-59848943621\n \"svchub.328.exe\" at 00012183-00003464-00000105-70787892702\n \"svchub.328.exe\" at 00012183-00003076-00000105-70981604484\n \"svchub.328.exe\" at 00012520-00004032-00000105-82793003196\n \"svchub.328.exe\" at 00012520-00000748-00000105-83155809318","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"svchub.328.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"abbschevis@protonmail.com\"\n Pattern match: \"ijuqodisunovib98@o2.pl\"\n Pattern match: \"mikllimiteds@gmail.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"%TEMP%\\svchub.328.exe\", Handle: 156)\n \"svchub.328.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\conhost.exe\", Handle: 280)\n \"svchub.328.exe\" is creating a new process (Name: \"%TEMP%\\svchub.328.exe\", Handle: 236)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.1/32, 192.168.240.25/32, 192.168.240.35/32, 192.168.240.37/32, 192.168.240.38/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$24","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$25","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin\" has a TLS callback with entrypoint at 0x482660","origin":"Static Parser","mitre_attack_id":"T1055","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n GetDriveTypeW\n CreateFileMappingA\n GetFileAttributesW\n MapViewOfFileEx\n UnhandledExceptionFilter\n GetTempPathW\n OutputDebugStringW\n DeviceIoControl\n CopyFileW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n CreateDirectoryExW\n LoadLibraryExW\n CreateThread\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n FindFirstFileExW\n CreateFileW\n CreateFileA\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n CreateProcessA\n WriteFile\n CreateProcessW\n Sleep\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$26","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29.bin\" (Offset: 453427)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/71 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/71 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$27","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$28","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"\"|[A-Za-z]:\\\\(pagefile\\.sys|hiberfil\\.sys|perflogs|boot.*|system volume information|cl.log|recovery|autoexec\\.bat|config\\.sys|io\\.sys|msdos\\.sys|ntdetect\\.com|ntldr)\"","origin":"File/Memory","relevance":9,"id":"string-0","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$29","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"svchub.2591.exe\" wrote bytes \"711177027a3b7602ab8b02007f950200fc8c0200729602006cc805001ecd73027d267302\" to virtual address \"0x753107E4\" (part of module \"USER32.DLL\")\n \"svchub.9633.exe\" wrote bytes \"711177027a3b7602ab8b02007f950200fc8c0200729602006cc805001ecd73027d267302\" to virtual address \"0x753107E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]}]},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":28,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":255,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","crypt","cryptlocker","downloader","genkryptik","kryptik","locker","lockergoga","ransomware","stealer"],"sample_flags":["Multi-Process","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5c937ca1028838ef7094b3d2","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Ransom.LockerGoga","submit_name":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","analysis_start_time":"2019-03-21T11:50:26+00:00","indicators_count":{"informative":10,"suspicious":10,"malicious":9},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"5c4f23cd7ca3e163b50a2a8b","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"svchub.2591.exe","analysis_start_time":"2019-01-28T16:58:38+00:00","indicators_count":{"informative":10,"suspicious":10,"malicious":7},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}],"processes":[{"pid":2468,"ppid":0,"name":"svchub.2591.exe","command_line":"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"C:\\svchub.2591.exe","uid":"00035408-00002468","icon":"$2a"},{"pid":4076,"ppid":2468,"name":"svchub.9633.exe","command_line":"-w","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035408-00002468","uid":"00035774-00004076"},{"pid":1260,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl Z:\\1548691135173$MAPFAILURE Z:\\1548691135173$OK Z:\\network.pcapng","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00036126-00001260"},{"pid":2128,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi\" \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00036133-00002128"},{"pid":3616,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab\" \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusWW.msi\" \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml\" \"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00036801-00003616"},{"pid":712,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab\" \"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm\" \"%PROGRAMFILES%\\7-Zip\\Lang\\lij.txt\" \"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00036810-00000712"},{"pid":2916,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\Peacock.jpg\" \"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\Peacock.htm\" \"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\OrangeCircles.jpg\" \"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\Orange Circles.htm\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00037563-00002916"},{"pid":2444,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\Roses.htm\" \"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\HandPrints.jpg\" \"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\Hand Prints.htm\" \"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\GreenBubbles.jpg\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00037979-00002444"},{"pid":1368,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%COMMONPROGRAMFILES%\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG\" \"%PROGRAMFILES%\\Java\\jre1.8.0_151\\lib\\cmm\\LINEAR_RGB.pf\" \"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl\" \"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00038227-00001368"},{"pid":3216,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl\" \"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl\" \"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF\" \"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00038831-00003216"},{"pid":3700,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF\" \"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF\" \"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF\" \"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00039167-00003700"},{"pid":284,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF\" \"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF\" \"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF\" \"%PROGRAMFILES%\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00039511-00000284"},{"pid":3776,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%PROGRAMFILES%\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF\" \"%PROGRAMFILES%\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF\" \"%PROGRAMFILES%\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF\" \"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00039932-00003776"},{"pid":2532,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF\" \"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF\" \"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF\" \"%PROGRAMFILES%\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00040326-00002532"},{"pid":3184,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%PROGRAMFILES%\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif\" \"%PROGRAMFILES%\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif\" \"%PROGRAMFILES%\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif\" \"%PROGRAMFILES%\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00040694-00003184"},{"pid":3160,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%PROGRAMFILES%\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML\" \"%PROGRAMFILES%\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV\" \"%PROGRAMFILES%\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML\" \"%PROGRAMFILES%\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00041030-00003160"},{"pid":2432,"ppid":4076,"name":"svchub.9633.exe","command_line":"-w -k \"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQCjgKjfHB95EC2b9dXX+DTaOLQ2GwpE0PWA +WmZoZV8Lbdzdbma1z0kOqiN2g/v5xE7eWV73jA9FoHqPkHjn0Lj/xbBdv+cA05UoN1aRlgd /J1zdYOajnd8kAsdoxPTYnSMO1hqnjrc3diBgjuLwXagiL1d2rOZJmTCcz5B5QrfPQIBEQ==\" -m AbbsChevis@protonmail.com -m IjuqodiSunovib98@o2.pl \"%PROGRAMFILES%\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html\" \"%PROGRAMFILES%\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png\" \"%PROGRAMFILES%\\Windows Sidebar\\en-US\\Sidebar.exe.mui\" \"%PROGRAMFILES%\\Windows Sidebar\\en-US\\sbdrop.dll.mui\"","sha256":"8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29","normalized_path":"%TEMP%\\svchub.9633.exe","parent_uid":"00035774-00004076","uid":"00041398-00002432"}],"all_imported_dlls":["kernel32.dll","KernelBase.dll","shlwapi.dll","user32.dll","apphelp.dll","ntdll.dll","msvcrt.dll","lpk.dll","ole32.dll","rpcrt4.dll","sechost.dll","imm32.dll","msctf.dll","usp10.dll","oleaut32.dll","api-ms-win-core-synch-l1-2-0.dll","cryptsp.dll","rsaenh.dll","cryptbase.dll","rpcss.dll","uxtheme.dll","shell32.dll","gdi32.dll","advapi32.dll","wow64cpu.dll","sspicli.dll","wow64win.dll","wow64.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"README-NOW.txt","sha256":"31fa8aae2e29a0bab45ca7460a4898a948bdbf6a3350b803301fac330b37e7df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"name":"wipe","sha256":"ca602802a61993b6074e6bebf76bd152c1b981a4ac931d7122e4bf110a2b0a28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]}],"files_written":[{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\$Recycle.Bin","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\Documents and Settings","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%TEMP%\\svchub.328.exe","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\7-Zip","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Adobe","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Esl","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\locales","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AIR","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Browser","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Javascripts","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Legal","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Locale","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Locale\\en_US","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm\\PMP","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Annotations\\Stamps\\ENU","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%SAMPLEDIR%\\1553169043275$MAPFAILURE.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%SAMPLEDIR%\\1553169043275$OK.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\Multimedia\\MPP","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\pi_brokers","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins3d\\prc","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Tracker","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\UIThemes","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\cef","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\hi_contrast","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\file_types\\themes\\dark","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\hi_contrast","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\themes","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\be.txt.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sk.txt.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Tracker\\pdf.gif.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%COMMONPROGRAMFILES%\\System\\msadc\\adcvbs.inc.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%COMMONPROGRAMFILES%\\System\\msadc\\adcjavas.inc.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%COMMONPROGRAMFILES%\\System\\en-US\\wab32res.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%COMMONPROGRAMFILES%\\System\\ado\\msadox28.tlb.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\images\\icons_ie8.gif.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main.css.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Exclamation.png.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\_NowTime.au3.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%COMMONPROGRAMFILES%\\System\\msadc\\handsafe.reg.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%COMMONPROGRAMFILES%\\System\\msadc\\handler.reg.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%COMMONPROGRAMFILES%\\System\\msadc\\en-US\\msdaremr.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%COMMONPROGRAMFILES%\\System\\msadc\\en-US\\msdaprsr.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Clipart\\CommonClipart\\KT_Custom\\Custo_10.PNG.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Clipart\\CommonClipart\\KT_Custom\\Custo_09.PNG.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\_NowDate.au3.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Clipart\\CommonClipart\\KT_Custom\\Custo_08.PNG.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\HwpTemplate\\Doc\\enu\\Stationery\\Staccato Color Letterhead without border.hwt.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Clipart\\CommonClipart\\KT_Custom\\Custo_07.PNG.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\hm[1].js.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\HitachiSocialInnovation[8].mp4.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\HitachiSocialInnovation[3].mp4.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\HitachiSocialInnovation[2].mp4.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OCO9PWXQ\\libs[1].js.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OCO9PWXQ\\leftservices[1].js.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"},{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\HitachiSocialInnovation[7].mp4.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\HitachiSocialInnovation[6].mp4.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\HitachiSocialInnovation[5].mp4.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0QPGGJBR\\HitachiSocialInnovation[4].mp4.locked","sources":[{"report_type":"sandbox","report_id":"5c937ca1028838ef7094b3d2"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%TEMP%\\svchub.9633.exe","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Common Files","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\DESIGNER","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ClickToRun","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\HWRCustomization","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%SAMPLEDIR%\\1548691135173$MAPFAILURE.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%SAMPLEDIR%\\1548691135173$OK.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lij.txt.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusWW.msi.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\Peacock.jpg.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\Peacock.htm.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\Orange Circles.htm.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\Roses.htm.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\HandPrints.jpg.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\Hand Prints.htm.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\lib\\cmm\\LINEAR_RGB.pf.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\en-US\\Sidebar.exe.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\en-US\\sbdrop.dll.mui.locked","sources":[{"report_type":"sandbox","report_id":"5c4f23cd7ca3e163b50a2a8b"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5c4f23cd7ca3e163b50a2a8b","5c937ca1028838ef7094b3d2"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Encoder Sample 8cfbd38855d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8cfbd38855d2…. Malware family: Trojan.Encoder. Threat score 100/100. 24/27 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Encoder Sample 8cfbd38855d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8cfbd38855d2…. Malware family: Trojan.Encoder. Threat score 100/100. 24/27 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Encoder Sample 8cfbd38855d2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8cfbd38855d2…. Malware family: Trojan.Encoder. Threat score 100/100. 24/27 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]