26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 8d54dbe841c9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8d54dbe841c9…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1"],"about":{"@type":"SoftwareApplication","name":"svchost.exe","applicationCategory":["peexe","executable"],"identifier":"8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T438,"\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!prmgrvu!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!prmgrvu!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\ConnHashTable<3368>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!prmgrvu!appdata!roaming!microsoft!windows!ietldcache!"28:T6c8,"zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "tor.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libevent_extra-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "tor-gencert.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libssp-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libgcc_s_sjlj-1.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent_core-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ssleay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "alot.com.url.DvsE" has type "ASCII text with very long lines with no line terminators" "8Uu9ETpS.avi.peYi" has type "ASCII text with very long lines with no line terminators" "cnet.com.url.mPCR" has type "data" "Jm34QKUSbOJ.pdf.MLEv" has type "ASCII text with very long lines with no line terminators" "java.com.url.CxLe" has type "ASCII text with very long lines with no line terminators" "4Pmmh3HlYKPz20b.doc.Y3pH" has type "data" "foxsports.com.url.9VbB" has type "ASCII text with very long lines with no line terminators" "monster.com.url.m36D" has type "ASCII text with very long lines with no line terminators" "ReadMe.txt" has type "ASCII text with very long lines with CRLF line terminators"29:T424,"" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Windows\System32\oleaccrc.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\prmGrvU\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\ntdll.dll" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "svchost.exe" touched file "C:\Windows\System32\rsaenh.dll"2a:Tad1,Pattern match: "http://nsis.sf.net/NSIS_Error" Heuristic match: "pendrivelinux.com" Heuristic match: "Copyright ?2010-2015 Lance Pendrivelinux.com" Heuristic match: "inux.com" Heuristic match: "yright ?2010-2015 Lance Pendrivelinux.com" Heuristic match: "HEAD /edgedl/release2/Hcq1Yqsih2A/57.0.2987.133_56.0.2924.87_chrome_updater.exe HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x80042194 X-Last-HTTP-Status-Code: 404 " Heuristic match: "GET /json HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzi" Heuristic match: "archive.torproject.org" Pattern match: "http://ocsp.int-x3.letsencrypt.org0/" Pattern match: "http://cert.int-x3.letsencrypt.org/0" Pattern match: "http://cps.letsencrypt.org0" Pattern match: "https://letsencrypt.org/repository/0" Pattern match: "http://isrg.trustid.ocsp.identrust.com0" Pattern match: "http://apps.identrust.com/roots/dstrootcax3.p7c0" Pattern match: "http://cps.root-x1.letsencrypt.org0" Pattern match: "http://crl.identrust.com/DSTROOTCAX3CRL.crl0" Pattern match: "www.wtbe.com" Pattern match: "www.xykuah626qziidwd72y.com" Pattern match: "www.bnkvnvji.com0" Pattern match: "www.oor6lzbtu6w6utai7ja.net0" Pattern match: "www.lvjmu3kvwhgl.com0" Pattern match: "www.xaowkvjvh7ddg4s.net0" Pattern match: "www.odgwb2qqqxal43z.com" Pattern match: "www.cuobkpvur2o.com0" Pattern match: "www.yz4mjo2iqmu.net0" Pattern match: "www.yvpi5i2sqjtettrzcnoynqm.com" Pattern match: "www.cvwvjxb2ashfq53jy.com" Pattern match: "www.pev7x65ewxj6fbof4w6e6wj.com" Pattern match: "www.f46vo2h6v7at5p5u4y.com" Pattern match: "www.jqxoocb2xwe.com0" Pattern match: "www.f4sk5bxgc62kjv2urvuv.net0" Pattern match: "www.artnolikilamwuwc.com0" Pattern match: "www.t7xf3vhp5a6kn7l.net0" Pattern match: "www.tsdpr7pwao6xtrms22.com0" Pattern match: "www.pd6nna3pqr5gmiicsw.net0" Pattern match: "www.k77cg7i.com" Pattern match: "www.mackvwltm2vokbsjf.com0" Pattern match: "www.373475gt4rjmi.net0" Pattern match: "www.ilvsbkmn2tguhqudxc7s.com0" Pattern match: "www.psu3pj77g.net0" Heuristic match: "ip-api.com" Pattern match: "http://www.zlib.net/" Heuristic match: "ip6.arpa" Heuristic match: "%d.%d.%d.%d.in-addr.arpa" Heuristic match: "google.com" Pattern match: "http://%s" Heuristic match: ".onion" Pattern match: "https://www.torproject.org/download/download#warning" Pattern match: "http://www.openssl.org/" Pattern match: "https://www.torproject.org/download/download-easy.html.en" Pattern match: "http://yowl2ugopitfzzwb.onion/"2b:T402,"zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "tor.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libevent_extra-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "tor-gencert.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "libssp-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libgcc_s_sjlj-1.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent_core-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ssleay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "libevent-2-0-5.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"2c:T96f,"What has happened to my files ? Why i am seeing this ? All of your files have been encrypted with RSA 2048 Encryption. Which means, you wont be able to open them or view them properly. It does NOT mean they are damaged. Solution Well its quite simple only we can decrypt your files because we hold your RSA 2048 private key. So you need to buy the special decryption software and your RSA private key from us if you ever want your files back. Once payment is made, you will be given a decrypter along with your private key , once you run that , All of your files will be unlocked and back to normal. So there are 2 ways to do this either you wait for a miracle and get your price doubled or follow instructions below carefully and get back your all important files. Payment procedure Download a special browser called "TOR browser" and then open the given below link. Steps for the same are - 1. Go to https://www.torproject.org/download/download-easy.html.en to download the "TOR Browser". 2. Click the purple button which says "Download TOR Browser" 3. Run the downloaded file, and install it. 4. Once installation is completed, run the TOR browser by clicking the icon on Desktop. 5. Now click "Connect button", wait a few seconds, and the TOR browser will open. 6. Copy and paste the below link in the address bar of the TOR browser. http://yowl2ugopitfzzwb.onion/ Now HIT "Enter" 7. Wait a few seconds, and site will open then enter your GUID mentioned below and process. 49713BE301EAE5E8DF52649AB3F90768 If you have problems during installation or use of Tor Browser, please, visit Youtube and search for "Install Tor Browser Windows" and you will find a lot of videos." (Source: ReadMe.txt, Indicator: "decrypt your files") "All of your files have been encrypted with RSA 2048 Encryption. Which means, you wont be able to open them or view them properly. It does NOT mean they are damaged." (Source: ReadMe.txt, Indicator: "files have been encrypted") "Well its quite simple only we can decrypt your files because we hold your RSA 2048 private key. So you need to buy the special decryption software and your RSA private key from us if you ever want your files back. Once payment is made, you will be given a decrypter along with your private key , once you run that , All of your files will be unlocked and back to normal." (Source: ReadMe.txt, Indicator: "decrypt your files")2d:Tb14,"" wrote bytes "2b451876f99c177678eb16767989167693971776d3331876a41d1876d0d9177611a617765c39187641cf1776e19c17760e451876b62f18764123177600bf177600000000473fbb7500000000ec226a7599e5677500000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "" wrote bytes "08572f76047838760000000051c15b7594985b75ee9c5b7575dc5d75273e5d75efb261750000000046ce1776013d187638ed1876cfcd177631231776de2f1876c4ca177680bb1776aa6e18769fbb177692bb177646ba17760abf177600000000" to virtual address "0x6A751000" (part of module "SHFOLDER.DLL") "" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "" wrote bytes "4053197758581a77186a1a77653c1b770000000000bf17760000000056cc1776000000007cca17760000000037683e756a2c1b77d62d1b770000000020693e750000000029a6177600000000a48d3e7500000000f70e177600000000" to virtual address "0x772B1000" (part of module "NSI.DLL") "" wrote bytes "92e6167779a81b77be721b77d62d1b771de2167705a21b77bee31677616f1b77684119770050197700000000ad370f768b2d0f76b6410f7600000000" to virtual address "0x747B1000" (part of module "WSHTCPIP.DLL") "" wrote bytes "7739177779a81b77be721b77d62d1b771de2167705a21b77c8681a7757d12177bee31677616f1b77684119770050197700000000ad370f768b2d0f76b6410f7600000000" to virtual address "0x74D01000" (part of module "WSHIP6.DLL") "iexplore.exe" wrote bytes "e9b34bcbf8" to virtual address "0x75BAEC7C" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9b2961bf9" to virtual address "0x756A9D0B" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "e955a50bf9" to virtual address "0x757C3EAE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e9efb980fa" to virtual address "0x7419388E" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e954a1dcf8" to virtual address "0x75BD3B7F" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e99cf3d9f8" to virtual address "0x75BFE869" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9fc7976fa" to virtual address "0x74237922" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e99ac367f7" to virtual address "0x77322694" (part of module "COMDLG32.DLL") "iexplore.exe" wrote bytes "e92e0ddbf8" to virtual address "0x75BECF42" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9b090c2f8" to virtual address "0x75BAABE1" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e96ff1d9f8" to virtual address "0x75BFE9C9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e98b8e1df9" to virtual address "0x757C5DEE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e937f2d9f8" to virtual address "0x75BFE963" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9c20adbf8" to virtual address "0x75BED274" (part of module "USER32.DLL")2e:T3497,Found malicious artifacts related to "185.194.141.58" (ASN: , Owner: ): ... File SHA256: d45f6256238c562b4412882fe1accdd209b95777f989957147dda8bc9719e64c (AV positives: 43/68 scanned on 11/08/2017 04:48:14) File SHA256: 60cfe0eec2adcf98f26c2ff712fca192010a81028f92f0289dd2c221ce5f782f (AV positives: 48/68 scanned on 11/08/2017 04:46:09) File SHA256: 139d9df749e58803b1dfcd11f9f075ec09a977ffb744e1376090b06c76eaf1c4 (AV positives: 47/68 scanned on 11/07/2017 18:03:47) File SHA256: 44e04e094853b0803fdb839b380defd8ef2abc860ed8f39d1ee950a6cfda030a (AV positives: 51/68 scanned on 11/07/2017 16:12:24) File SHA256: 01349f52bc4c2f8f98dc6edd61652a1124e9523f4db3894fe57c70918282d067 (AV positives: 49/63 scanned on 11/07/2017 15:30:22) File SHA256: 8945bc05c7ed72b4fb7ba59d0a3eedc5679dc823ffbe005dec2212238de8b254 (Scanned on 11/07/2017 06:42:45) File SHA256: 60f921376b46c86bc2186534aa26e628ebb640764856407217c79c723a00f017 (Scanned on 11/04/2017 10:39:44) File SHA256: 16c37a45e4b5cfc1ff3d23b5926b9b791427a46ee5d039ac7d095c39ef97edf7 (Scanned on 11/04/2017 10:14:01) File SHA256: 37cf2f43f2f14aa517b4bd81bcb00b06065429db4755158ed20afebd213dbf09 (Scanned on 11/02/2017 14:27:48) File SHA256: 83d2e4a5caafb3b20ec49a5441ce52fea7e47b0caac2d466adfa0aea26f29aab (Scanned on 11/02/2017 06:55:25) Found malicious artifacts related to "82.195.75.101" (ASN: , Owner: ): ... URL: http://82.195.75.101/ (AV positives: 1/64 scanned on 10/09/2017 09:40:29) URL: http://torproject.com/ (AV positives: 1/68 scanned on 10/18/2016 10:56:15) URL: http://torproject.org/ (AV positives: 1/66 scanned on 01/28/2016 09:35:13) URL: http://www.torproject.org/ (AV positives: 1/65 scanned on 10/02/2015 08:31:31) URL: https://dist.torproject.org/torbrowser/4.0.8/torbrowser-install-4.0.8_en-US.exe (AV positives: 1/62 scanned on 04/23/2015 16:32:55) File SHA256: fb4c330361d8a7449ed4b9a30848bdad47616166af64f7ace4c71ead83464780 (AV positives: 1/61 scanned on 10/19/2017 18:52:08) File SHA256: 0350d344dad44dd586620cfc5d9031db09f6dab363cf241de34ae22cb88626f8 (AV positives: 34/65 scanned on 10/04/2017 03:48:37) File SHA256: 69640b017e7478d0e056d04975b444c940cfb4f1496bccb5b1a0e068f77ce3ea (AV positives: 3/57 scanned on 08/08/2017 17:09:34) File SHA256: 799d875bd30e144c09883beb28ee5e8d264228fba8ecdaed50efbb5ab95b7d06 (AV positives: 22/60 scanned on 07/31/2017 22:32:11) File SHA256: fcae8f28c03d35619774a7dd8e2424f058fdf9138899727b572168b9f3c8840e (AV positives: 58/64 scanned on 07/27/2017 01:47:21) File SHA256: 6e5d10ba388a5200d45a2059add694d56d1f1cd50f82087a06eb68d808b0e357 (Scanned on 06/27/2017 14:07:01) File SHA256: baec01fd95fae681d260c0f7e26b6d5a7d2370f399b5711592d6df8320324546 (Scanned on 05/23/2017 16:30:32) File SHA256: 30b463466bfee567f4b4c741b00683b702ba508310ee7f53c84efc8c24a45f51 (Scanned on 03/12/2017 05:50:32) File SHA256: e91bf82d1754b791552b90c5f626a04cae87eb2326e927d3981332c0c433cf8c (Scanned on 01/18/2017 00:07:42) Found malicious artifacts related to "86.59.119.88" (ASN: , Owner: ): ... URL: http://86.59.119.88/ (AV positives: 1/64 scanned on 09/28/2017 02:06:19) URL: http://86.59.119.88/tor/status-vote/current/consensus-microdesc/0232AF+14C131+23D15D+49015F+D586D1+E8A9C4+ED03BB+EFCBE7.z (AV positives: 1/64 scanned on 02/11/2017 03:42:01) URL: https://86.59.119.88/ (AV positives: 1/68 scanned on 08/30/2016 17:42:06) File SHA256: c3e07abd299b6dbad03691269444f97eea4d213f56b01ae30fed1bffcb59ac88 (Scanned on 11/04/2017 12:31:10) File SHA256: 600017dd7f275b0eefb9caebc72d1022e04d3fc8ae008b4796d73cafc3594c75 (Scanned on 11/04/2017 12:13:53) File SHA256: 2a8c626dd71c72a871493490a8349f639103663f769acf16ff0577d9f2321ab8 (AV positives: 13/68 scanned on 10/31/2017 11:37:55) File SHA256: 222dc66dcffd068dbe945f87af7bc2ab9a3b2eae236ce17754bfeaccaa128ee6 (AV positives: 54/67 scanned on 10/28/2017 16:44:42) File SHA256: 00be8a0d6fff70be569ee757bd57136ea5274ce2444915cd380ca1f356c23303 (AV positives: 5/67 scanned on 10/28/2017 14:21:42) File SHA256: 9805c919d38fcd144891302a2eced927c1e057f073a27f20dc1006b4088d357d (AV positives: 6/68 scanned on 10/28/2017 14:21:19) File SHA256: a4996d3f49651fc1f8be1088b72463e43533bfd834b2da499e15b2a78aa29090 (AV positives: 32/67 scanned on 10/26/2017 10:46:16) File SHA256: 2c8eee731f0f66fa8345321675251f3552d11458c2dea71ad870f94eefee9dd6 (Scanned on 08/30/2017 10:08:45) File SHA256: f4c6d7f27880b0775f8efd604e1c6afb23928f4f1976b455358c6eb689d71dfb (Scanned on 08/29/2017 18:25:28) File SHA256: 938f9a0e2c3657f18c58af0e818736272dfade3994758dd533ac63e46ca31c02 (Scanned on 08/29/2017 17:49:46) Found malicious artifacts related to "86.59.21.38" (ASN: , Owner: ): ... URL: http://tor.noreply.org/ (AV positives: 2/64 scanned on 11/07/2017 21:39:12) URL: http://86.59.21.38/ (AV positives: 2/63 scanned on 10/30/2017 16:43:14) URL: http://86.59.21.38/tor/server/d/24BDBD8DE7E8022B0B8793261FB733666884D558%2024BF1BAC2B5D3CA6989713A22DB6D167A72E7CD4%2024C7D10A940810BD1F692B4CA408685991D93258%2024CAF6DE041CFB049981C7C273B6AAFE2005E50B%2024D0DCD5B1C2EAEC9125EDBCD636E7C3D1033C3C%2024DA541D39F6BD6A310F5D452130B89B3C2FE8DF%2024E6BEE3ACE9E86BED6E82FD30B7C645454383B7%2024E71C97964585047732FF08A0B19F11D2442ED9%2024ED06F546EE369C79EA184D45A88CC43D8F91A6 (AV positives: 2/64 scanned on 09/21/2017 00:02:33) URL: http://86.59.21.38/tor/status-vote/current/consensus/ (AV positives: 1/65 scanned on 08/04/2017 09:03:40) URL: http://86.59.21.38/tor/status-vote/current/consensus (AV positives: 2/65 scanned on 08/02/2017 04:26:16) File SHA256: c4d2262a0ab97708569d620678a0643267a3f534c93eb4ed035b058a5d5242ae (AV positives: 31/67 scanned on 11/08/2017 13:16:57) File SHA256: eb0e281f75253e80dd7bf61e382f6fbd15989348f028824c37f9acce831d2ea6 (AV positives: 10/67 scanned on 11/08/2017 07:58:25) File SHA256: d42b3cd67bdad5f34b58bb0fc4715131b8d0040cbac01272e67c45a9d815b2ac (AV positives: 11/68 scanned on 11/07/2017 11:43:02) File SHA256: b4312a4e1a0d65e58da25b6ac8c854f32c826662a57c889ddc85c3c06ba8a9f0 (Scanned on 11/07/2017 19:46:10) File SHA256: 57cb163b105e3be66fa73191b9a28b250de3f52e791aab4a27af0a2eb84b3647 (Scanned on 11/07/2017 19:45:15) File SHA256: f0b4d5a6839b5b92549423d575e952cda7f54ac1f49c0ce1dc0410c976008d2d (AV positives: 52/68 scanned on 11/03/2017 16:58:48) File SHA256: 25c547d912a85c7bca16b4eac50fdc8bfa4ff4fdb6d0572ccd26cd61576ef19f (AV positives: 49/68 scanned on 11/03/2017 16:57:47) File SHA256: e579f338e5b86618d06be55d73834451164f3fc49531d985eddf0c273925f706 (Scanned on 10/23/2017 12:08:38) File SHA256: 868f7344fa4656969d918e89a5b60f87022b897b939c5650a41a61b4e259db8c (Scanned on 10/23/2017 11:02:59) File SHA256: 208699a6ebad95a916804efffd83ed5225eea2e3be1fea289a89152b30ade067 (Scanned on 10/23/2017 04:51:05) Found malicious artifacts related to "85.214.62.48" (ASN: , Owner: ): ... File SHA256: f0b4d5a6839b5b92549423d575e952cda7f54ac1f49c0ce1dc0410c976008d2d (AV positives: 52/68 scanned on 11/03/2017 16:58:47) File SHA256: 889e88ba8e82034b590d523ace16bb4a7bcdf6dffa6c3d35d1f5b56b00cebe99 (AV positives: 24/66 scanned on 10/20/2017 11:47:47) File SHA256: 9fc37b968849454486ed2a58753cb3f56df39079e64561e19a7ab364dd6a603b (AV positives: 1/67 scanned on 10/20/2017 08:38:24) File SHA256: 10df26b2017bb764133157b918e5c07e396925f78185967a3c82e4fb645c56b3 (AV positives: 5/66 scanned on 10/12/2017 05:05:37) File SHA256: 8de4e5206da5951746bd3dcc6e4a367b9c346e1ca63d2d324b0d9addd229b927 (AV positives: 15/64 scanned on 10/05/2017 16:40:11) File SHA256: c7c68877d2c16a5443ef83dd53aefaf431f82a1399aca03a8864d0d46606a61e (Scanned on 08/31/2017 13:53:36) File SHA256: f4d99cb6c68c6329d5430ab5bf0ad6346f885596aa06684cb6d62efef5ea6e2e (Scanned on 08/31/2017 13:50:23) File SHA256: 84f27eec1724eaa3895e35929306c9c527025d8e31cf6552864c6a6e4787c0fe (Scanned on 07/06/2017 04:59:31) File SHA256: 17223e4bf40c6d51b58d430ee278edc8b921034037ef8a14a0e22b1478464adb (Scanned on 07/02/2017 02:14:14) File SHA256: 62438d9ec56061fb81f514d6c8eff718f765d3101c16f70051c605deb3e4d788 (Scanned on 07/02/2017 02:11:13) Found malicious artifacts related to "149.56.45.200" (ASN: , Owner: ): ... URL: http://mail.beercappoker.com/ (AV positives: 1/64 scanned on 02/11/2017 00:41:23) File SHA256: 7b3c49cdc32e2eadfe6c6125c6b6108aea227f3596ac8b861d37d47e8c69d69e (AV positives: 51/68 scanned on 11/03/2017 16:57:47) File SHA256: fc993fbcb913f7e2d0ca8c0692ac180b0dbb1301c4e54cc6d3d6f072ea3c660e (AV positives: 16/66 scanned on 10/19/2017 17:34:02) File SHA256: db8795829516c796e353ced94b45ae5c3ca3f09062bc34303e1f2f7ea54e3e7b (AV positives: 15/66 scanned on 10/19/2017 16:09:00) File SHA256: a3a162a945f387e491f4c3a201f403fa70481fc0b077a3e74d209f2d74dcc6c2 (AV positives: 40/65 scanned on 10/18/2017 09:00:35) File SHA256: e74d5d5f6b818c81c9a49439724a47f3b7c54777c34c29335c015e4a358f634b (AV positives: 22/66 scanned on 10/13/2017 02:35:52) File SHA256: f9946714b9e6c5a3d444a148489ea1eb0928bf488b05b380badbcc0b3e2f9e6e (Scanned on 07/31/2017 01:19:29) File SHA256: d5eee03e87a84427ddf7cec3f55214ac85ba868577d3cc4838b7cceb43ed7297 (Scanned on 07/31/2017 00:09:17) File SHA256: dd157bbb20a1a2dc716f6e4c214ffe90b84c46f8362fec06989b01fa463c51b7 (Scanned on 07/31/2017 00:04:49) File SHA256: 9e25980b20b8128616271d3de4e73096aa5929e73a6a99d1fe66d3156177998d (Scanned on 07/22/2017 19:15:08) File SHA256: 37c303e7ff5d6974c4a5c0c5c141818728e617a9e744e126e84d49e152e6e9d1 (Scanned on 07/06/2017 13:01:59) Found malicious artifacts related to "46.105.63.44" (ASN: , Owner: ): ... File SHA256: e18290b61aaea276681079c5d356e275ee040b1db36e5d71adfcbdda144763b7 (AV positives: 11/68 scanned on 10/27/2017 09:50:53) File SHA256: 0799a20ef8ec87ca7a46bfd49dc81658be582b063653150a867f53fcfe12b1b1 (AV positives: 11/67 scanned on 10/27/2017 08:19:42) File SHA256: f0ed9045a7326e1c658101ec64bd58010793f75bb45dc0dd837ed04a6ce6f2c9 (AV positives: 34/68 scanned on 10/26/2017 10:51:37) File SHA256: 8468b402d96bd4af5d4fa3149351ff2483517030e6c980f949f9e78f34c88ca6 (AV positives: 44/67 scanned on 10/24/2017 02:17:20) File SHA256: e74d5d5f6b818c81c9a49439724a47f3b7c54777c34c29335c015e4a358f634b (AV positives: 22/66 scanned on 10/13/2017 02:35:56) File SHA256: b65edd9fa400a24900a352721af46e7e6f9e91b1a01a100d46054c9c793bd530 (Scanned on 08/31/2017 03:54:57) File SHA256: 24e80dc75925f6210a48ade7b25e18fab23849e758202ba70d61345d9ba17c00 (Scanned on 08/22/2017 03:35:56) File SHA256: 7d720d3142c64af67f74792f84591a906ea7e4320faf6a067c285f3757c7020b (Scanned on 08/22/2017 03:31:20) File SHA256: 96c840de4ac5b20ebd04182459c30f63f23a171e9f386d24d8512a4e02ca5630 (Scanned on 07/29/2017 01:25:15) File SHA256: 334673130ce893c8733bdd79eff8244c53d097a776a7b19db7117f365379ca9f (Scanned on 07/05/2017 00:52:40) Found malicious artifacts related to "193.11.114.43" (ASN: , Owner: ): ... URL: http://193.11.114.43/ (AV positives: 1/64 scanned on 10/18/2017 15:25:04) URL: http://193.11.114.43:9001/ (AV positives: 1/64 scanned on 05/19/2017 15:27:57) File SHA256: 909c0c9f3b8e95a0e6997a3960f5a58b6a129b49df2e7abf104c76b14f396940 (Scanned on 11/04/2017 10:23:13) File SHA256: f0b4d5a6839b5b92549423d575e952cda7f54ac1f49c0ce1dc0410c976008d2d (AV positives: 52/68 scanned on 11/03/2017 16:58:47) File SHA256: bf97d05212c8d42e145d4fbf43a5ca78ae7cb3896bdcc6e4c78cab379a10d83f (AV positives: 11/68 scanned on 10/30/2017 09:28:48) File SHA256: ad032c2e46eb94850d2b4d12ef0eb4f2edccd511480093992dfd2b2a97cdb2d4 (AV positives: 41/63 scanned on 10/25/2017 11:46:12) File SHA256: 8c1a18a3842e22b5233eb1e294bb9d15ea09bb43ef168b838ada5cff3dabf4c3 (AV positives: 39/67 scanned on 10/21/2017 20:03:24) File SHA256: 2aaf26129ee93eba04ff904814265cc89a5065a4a122a02fb86df45e8eed4a67 (AV positives: 18/64 scanned on 09/30/2017 19:05:25) File SHA256: a4f1649bccabe58521b2e811878460f9ef3d34bfb39f55453ac601894530db7e (Scanned on 08/24/2017 01:03:56) File SHA256: 04f976e96569c311026d1eba3b6ea37ac4574436a2b9ef7f25ca0ad1ad2ff301 (Scanned on 08/23/2017 20:00:25) File SHA256: fa7f2c181d6242a7e2f7f62e99ae0b8d10f3c51659c034bef1c458827543955c (Scanned on 08/23/2017 18:51:41) File SHA256: 5d0edeeb5aef75f27b4fa7ffab03cfc63a21e9f2bccdb3f58806b17a2e21f4f9 (Scanned on 08/23/2017 10:24:54) Found malicious artifacts related to "178.62.201.15" (ASN: , Owner: ): ... File SHA256: eb0e281f75253e80dd7bf61e382f6fbd15989348f028824c37f9acce831d2ea6 (AV positives: 10/67 scanned on 11/08/2017 07:58:26) File SHA256: aeff3a264612b9b7867778dc3ba6b19174459522e1cd08d678d3582069035496 (AV positives: 10/68 scanned on 10/27/2017 12:23:55) File SHA256: 0e026fdfdaca8f1d6096289a31f2932abafb50bb57527cb4b2a291d3cd314022 (AV positives: 11/66 scanned on 10/19/2017 09:45:17) File SHA256: 70352ec87a755f3a55e76725b7a143819a38efce4941f91d534b5652539fccf2 (Scanned on 08/31/2017 16:47:34) File SHA256: 2c11166251da33a0a3a32b784b8d83b0c561976ed5508148e97691aadb47361c (Scanned on 08/31/2017 16:42:34) File SHA256: 049b53ab836265171437eea20558c3ba3dfc6b27c83870735d1801dfd150721d (Scanned on 08/27/2017 01:52:26) File SHA256: 8845c36dfa550ad5146026fcb9518a60018c33cb6cc300e7828d4b8a9c248bf7 (Scanned on 08/27/2017 01:34:39) File SHA256: 3fbf3c888d232e48c8dfd98011df1f420f711c6f7a0fbfee935379096939d7cd (Scanned on 08/27/2017 01:31:20) File SHA256: ffa3500af647825aaa1dd034af2a986ba6c42fe3e786ff57428d1a86632a09d7 (AV positives: 14/64 scanned on 07/28/2017 05:06:37) File SHA256: 44605e8c864ff14d1c5cae6dfac9c273c29b1aad4ceea1ec22c7e2ea35a0fb06 (AV positives: 8/64 scanned on 07/18/2017 15:57:49)2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAB3AAAAAAAAAAAAAAAAAAB3iIqgAAAHiIf4dwAAAAAHiIiKq7AAAHiId4hwAAAAf4iIirvuAAAH+/v7+wAAAHj4iIq+6AAAAHd3d3dwAAeIj4j6voiAAAAAAAAAAAAHiIj3B+iIgAAAAAAAAAAAB4iIoPCIiIB4iIiIiIiIiIeIqucHiIiAeIiIiIiIiIiHiq7r+PiIgHiIiIiIiIiIiHruu4iPiAB4iIiIiAAAAAB+7ruIiPgAeIiIiIiIiIiIh+u7iIiAAH////////////93u4iHcAAHd3d3d3d3d3d3eHd3cAABAAAAAAAAAAAAAHeHcAAAAQB4iIiIiIiIiIcHeHAAAAEAf/////////+HcHdwAACRAH93d3d3d3d/h3AAAAAAkQB/cAAAAAAAf4dwAAAACZEAf3AAAAAAAH+HcAAAAJkQAH9wAAAAAAB/h3AACQmZEAB/cAAAAAAAf4dwAAmZkQAAf3AAAAAAAH+HcACZkRAAAH9wAAAAAAB/h3AAmZkQAAB/cAAAAAAAf4dwABEREAAAf3AAAAAAAH+HcAAAAAAAAH93d3d3d3d/h3AAAAAAAAB/iIiIiIiIiIdwAAAAAAAAB//////////3cAAAAAAAAAB4iIiIiIiIj3AAAAAAAAAAB3d3d3d3d3dwAAAAAAD///wfAD/wB4Af4APAD8AB4AfAAfADgAD//4AAgAAAAAAAAAAAAAAAAAAAAQAAAAEAAAADAAAAB4AAAB7AAAA8wAAAPMAAAHjAAAP4wAAD8MAAAyHAAAMBwAADA8AAAgfAAAIHwAACB8AAA//AAAP/wAAD/+AAA//wAAP/+AAH/w==30:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==31:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiwAAAAAAAAAAAAAAAAAAiIu7M7sAAAAAAAAAAAAAD4iLM7uzMwAAAAAAAAAAAA+IszcAC7uzBmYAAAAAAAAPiLMwAAAHd2ZmZmYAAAAAD4izMAAEZmZu7mZmRAAAAA+IszAERGbu6IjuZmRAAAAIiLOwQEZu7oiI7uZmQEAACIizswRmbu6IiO7mZmQAAAiLu7NGZm7u5mZu5mZmAAAIi7uzRmZm5kAARuZmZkAAAIu7u3ZmbmAAAABuZmZgBgCLu7u2Zm5gAAAARmZEQAcACLuLt2ZmQAAAAAQAAAAHAAC7e7tmZkZmZmZmZEQACAAAi3i7dkZmZmZmZmZmZAcAAAM3i7dEZmZmZmZmZmQAAAAAN4u7ZEZmZmZmZmZkAAAAAAd4u3YARERmZmZmZAAAAAAEeIu3QAAAAGZmZmQEAAAAAGeIuzcAAAZmZmZkAAAAAABmeIu3ePiGZmZmYEAAAAAARmeIu2ZmZmZmZkQAAAAAAAZ2eIu3d3d3d3YAAAAAAAAAd3eIu4iId3dkYANwAAAAAAeIiIu4iIiGBgALMAAAAAAAR4j4u4iHQEAACzAAAAAAAABHeIe7cEAAAAAwAAAAAAAAAAAAi7MwAAADMAAAAAAAAAAAAAi7uzNzMzAAAAAAAAAAAAAACLu7O7MAAAAAAAAAAAAAAAAAAAAADH////gB///wAH//8BwR//A/AB/wPAAH8DAAAfAgAADwAAAAcAAAAHAAAAA4AA8AGAAfgBwAP8AeAAAAHgAAAB8AAAAfAAAAHwAAAB8AP4AfAB8AP4AAAD+AAAB/wAAA/+AAAM/wAAHP+AADz/4AD+//gA/P//8AD///wB/////w==33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiwAAAAAAAAAAAAAAAAAAiIu7M7sAAAAAAAAAAAAAD4iLM7uzMwAAAAAAAAAAAA+IszcAC7uzBmYAAAAAAAAPiLMwAAAHd2ZmZmYAAAAAD4izMAAEZmZu7mZmRAAAAA+IszAERGbu6IjuZmRAAAAIiLOwQEZu7oiI7uZmQEAACIizswRmbu6IiO7mZmQAAAiLu7NGZm7u5mZu5mZmAAAIi7uzRmZm5kAARuZmZkAAAIu7u3ZmbmAAAABuZmZgBgCLu7u2Zm5gAAAARmZEQAcACLuLt2ZmQAAAAAQAAAAHAAC7e7tmZkZmZmZmZEQACAAAi3i7dkZmZmZmZmZmZAcAAAM3i7dEZmZmZmZmZmQAAAAAN4u7ZEZmZmZmZmZkAAAAAAd4u3YARERmZmZmZAAAAAAEeIu3QAAAAGZmZmQEAAAAAGeIuzcAAAZmZmZkAAAAAABmeIu3ePiGZmZmYEAAAAAARmeIu2ZmZmZmZkQAAAAAAAZ2eIu3d3d3d3YAAAAAAAAAd3eIu4iId3dkYANwAAAAAAeIiIu4iIiGBgALMAAAAAAAR4j4u4iHQEAACzAAAAAAAABHeIe7cEAAAAAwAAAAAAAAAAAAi7MwAAADMAAAAAAAAAAAAAi7uzNzMzAAAAAAAAAAAAAACLu7O7MAAAAAAAAAAAAAAAAAAAAADH////gB///wAH//8BwR//A/AB/wPAAH8DAAAfAgAADwAAAAcAAAAHAAAAA4AA8AGAAfgBwAP8AeAAAAHgAAAB8AAAAfAAAAHwAAAB8AP4AfAB8AP4AAAD+AAAB/wAAA/+AAAM/wAAHP+AADz/4AD+//gA/P//8AD///wB/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790442551990,"unified_at":"2026-09-26T17:09:11.990Z","metadata":{"hashes":{"sha256":"8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1","sha1":"7b4d1828d5d006eb2df1c9a4cc3ee7a69519edd0","md5":"674936a2beb25def88db410f3d1b68de","sha512":"1b2569c79007736c00385e6aabeefb2f0dcd5218051e07f0277d3a03da1b171446463e318acc4a3234c72cc5605841ee7e7882fb0c3fcd9b73fe73ba6047920e","ssdeep":"98304:Jsz/o+ZX+W1oovCPyVUlenqWgelD4dk4V06Ql:o/dOA6yVUSgehfP/l","ssdeep_chunks":["98304:Jsz/o+Z","98304:sz/o+ZX","98304:z/o+ZX+","98304:/o+ZX+W","98304:o+ZX+W1","98304:+ZX+W1o","98304:ZX+W1oo","98304:X+W1oov","98304:+W1oovC","98304:W1oovCP","98304:1oovCPy","98304:oovCPyV","98304:ovCPyVU","98304:vCPyVUl","98304:CPyVUle","98304:PyVUlen","98304:yVUlenq","98304:VUlenqW","98304:UlenqWg","98304:lenqWge","98304:enqWgel","98304:nqWgelD","98304:qWgelD4","98304:WgelD4d","98304:gelD4dk","98304:elD4dk4","98304:lD4dk4V","98304:D4dk4V0","98304:4dk4V06","98304:dk4V06Q","98304:k4V06Ql","196608:Jsz/o+Z","196608:sz/o+ZX","196608:z/o+ZX+","196608:/o+ZX+W","196608:o+ZX+W1","196608:+ZX+W1o","196608:ZX+W1oo","196608:X+W1oov","196608:+W1oovC","196608:W1oovCP","196608:1oovCPy","196608:oovCPyV","196608:ovCPyVU","196608:vCPyVUl","196608:CPyVUle","196608:PyVUlen","196608:yVUlenq","196608:VUlenqW","196608:UlenqWg","196608:lenqWge","196608:enqWgel","196608:nqWgelD","196608:qWgelD4","196608:WgelD4d","196608:gelD4dk","196608:elD4dk4","196608:lD4dk4V","196608:D4dk4V0","196608:4dk4V06","196608:dk4V06Q","196608:k4V06Ql","98304:o/dOA6y","98304:/dOA6yV","98304:dOA6yVU","98304:OA6yVUS","98304:A6yVUSg","98304:6yVUSge","98304:yVUSgeh","98304:VUSgehf","98304:USgehfP","98304:SgehfP/","98304:gehfP/l"],"imphash":"57e98d9a5a72c8d7ad8fb7a6a58b3daf"},"file_info":{"file_name":"svchost.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3207826,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1510153522000,"last_seen":1677376067000,"last_multi_scan":1677376067000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["sigma","ransomware"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":19,"suspicious_count":25,"malicious_count":12,"total":56},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1224848","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ser.Ursu.15042","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-6369945-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ransom.KA.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.Sigma.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051b6561 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.NSIS.Cayu.ejc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-ESB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_SIGMA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_SIGMA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dnldr25.DBEI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Cayu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 20246-898-62126270\n SetUnhandledExceptionFilter@KERNEL32.dll at 25386-134-62E92C70\n SetUnhandledExceptionFilter@KERNEL32.dll at 27214-1669-659C0050\n SetUnhandledExceptionFilter@KERNEL32.dll at 32697-7-004014E0\n SetUnhandledExceptionFilter@KERNEL32.dll at 27395-1007-6E450300","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 33829-7-631F4380","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\"; Value: \"00000000010000004800000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072003B000000\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SVCHOST.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SVCHOST.EXE\")\n \"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY TLS possible TOR SSL traffic\" (SID: 2018789, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"\n \"archive.torproject.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.194.141.58:80\"\n \"82.195.75.101:443\"\n \"86.59.119.88:443\"\n \"86.59.21.38:443\"\n \"85.214.62.48:443\"\n \"149.56.45.200:9001\"\n \"46.105.63.44:9001\"\n \"193.11.114.43:9001\"\n \"178.62.201.15:9090\"\n \"91.121.160.215:9001\"\n \"1.1.1.1\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\nse47D9.tmp\"\n \"\" created file \"%TEMP%\\886045802\"\n \"\" created file \"%TEMP%\\nsv4853.tmp\\System.dll\"\n \"\" created file \"%TEMP%\\nsv4853.tmp\\System.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$27","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"libeay32.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"libevent_core-2-0-5.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"libevent-2-0-5.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /json HTTP/1.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0\nAccept-Language: en-us,en;q=0.5\nAccept-Encoding: gzip\nHost: ip-api.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00024995-00003368)\n Launches browser \"iexplore.exe\" (UID: 00025025-00003388)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00024995-00003368) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"\n Process \"cmd.exe\" (UID: 00025036-00003444) was launched with missing environment variables: \"PATH\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe\"\" on 2017-11-8.15:54:14.791","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00015663-00003212)\n Spawned process \"svchost.exe\" (UID: 00019889-00003000)\n Spawned process \"iexplore.exe\" with commandline \"-nohome\" (UID: 00024995-00003368)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3368 CREDAT:79873\" (UID: 00025025-00003388)\n Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe\"\" (UID: 00025036-00003444)\n Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 1 -w 3000\" (UID: 00025047-00003488)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"If you have problems during installation or use of Tor Browser, please, visit Youtube and search for \"Install Tor Browser Windows\" and you will find a lot of videos.\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"iexplore.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.08290294622","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"ECDSA\" (Indicator: \"ecdsa\"; File: \"tor.exe.696262737\")\n \"RC4\" (Indicator: \"rc4\"; File: \"ssleay32.dll.3078793775\")\n \"DES\" (Indicator: \"des\"; File: \"ssleay32.dll.3078793775\")\n \"AES128\" (Indicator: \"aes128\"; File: \"ssleay32.dll.3078793775\")\n \"AES256\" (Indicator: \"aes256\"; File: \"ssleay32.dll.3078793775\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/64 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"iexplore.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"iexplore.exe\" called \"OpenService\" to access the \"rasman\" service\n \"iexplore.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"iexplore.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_CONFIG\" (0X1) access rights\n \"iexplore.exe\" called \"OpenService\" to access the \"WSearch\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"iexplore.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"WSearch\"\n \"iexplore.exe\" called \"ControlService\" and sent control code \"0XDC\" to the service \"WSearch\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$2b","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"CHROME\"; Value: \"Rundll32.exe SHELL32.DLL,ShellExec_RunDLL %APPDATA%\\Microsoft\\49713BE301EAE5E8DF52649AB3F90768\\taskwgr.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"18.244.0.188\"\n \"127.0.0.1\"\n Heuristic match: \"127.0.0.1 localhost\"\n Heuristic match: \"(on Tor 0.3.0.7 cfd9c1bdc0582656)\"\n \"0.3.0.7\"\n Heuristic match: \"0.2.4.8-alpha\"\n Heuristic match: \"Nov 08 15:52:46.913 [notice] Tor 0.3.0.7 (git-cfd9c1bdc0582656) running on Windows 7 with Libevent 2.0.22-stable, OpenSSL 1.0.2k and Zlib 1.2.8.\"\n Heuristic match: \"Nov 08 15:52:47.013 [notice] Opening Socks listener on 127.0.0.1:9050\"\n Heuristic match: \"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe\"\"\n Heuristic match: \"ping 1.1.1.1 -n 1 -w 3000\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2c","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"Found dropped filename \"kDy3FUkn.jpg.chip\" which has been seen in the context of ransomware (Indicator: .CHIP)","origin":"Binary File","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 922 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"cmd=\" (Indicator: \"cmd=\")","origin":"File/Memory","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 1 -w 3000\" (UID: 00025047-00003488)","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"zlib1.dll\" claimed CRC 145013 while the actual is CRC 3268861\n \"tor.exe\" claimed CRC 3340358 while the actual is CRC 145013\n \"libevent_extra-2-0-5.dll\" claimed CRC 451113 while the actual is CRC 3340358\n \"libeay32.dll\" claimed CRC 3230883 while the actual is CRC 451113\n \"tor-gencert.exe\" claimed CRC 1040324 while the actual is CRC 3230883\n \"libssp-0.dll\" claimed CRC 107654 while the actual is CRC 1040324\n \"libgcc_s_sjlj-1.dll\" claimed CRC 540122 while the actual is CRC 107654\n \"libevent_core-2-0-5.dll\" claimed CRC 467440 while the actual is CRC 540122\n \"ssleay32.dll\" claimed CRC 764532 while the actual is CRC 467440\n \"libevent-2-0-5.dll\" claimed CRC 781000 while the actual is CRC 764532","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n OpenProcessToken\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteExA\n FindWindowExA\n TerminateProcess\n UnhandledExceptionFilter\n VirtualProtect\n GetModuleFileNameW\n GetVersionExA\n LoadLibraryA\n OpenProcess\n MapViewOfFile\n GetStartupInfoA\n CreateFileMappingA\n accept\n WSAStartup\n connect\n closesocket\n send\n listen\n recv\n socket\n bind\n recvfrom\n sendto\n WSASend\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2d","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"iexplore.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"zlib1.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent_extra-2-0-5.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libeay32.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libssp-0.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libgcc_s_sjlj-1.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent_core-2-0-5.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"ssleay32.dll\" claims program is from Thu Jan 1 00:00:00 1970\n \"libevent-2-0-5.dll\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"svchost.exe\" at non-system pathway \"%APPDATA%\\Microsoft\\49713BE301EAE5E8DF52649AB3F90768\\Tor\\svchost.exe\" (UID: 00019889-00003000)","origin":"Monitored Target","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\Microsoft\\49713BE301EAE5E8DF52649AB3F90768\\taskwgr.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/67 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/85 Antivirus vendors marked dropped file \"zlib1.dll\" as malicious (1% detection rate)\n 1/86 Antivirus vendors marked dropped file \"tor.exe\" as malicious (classified as \"Trojan.Heur\" with 1% detection rate)\n 2/85 Antivirus vendors marked dropped file \"libevent_extra-2-0-5.dll\" as malicious (classified as \"Process crashed\" with 2% detection rate)\n 1/83 Antivirus vendors marked dropped file \"tor-gencert.exe\" as malicious (classified as \"Trojan.Heur\" with 1% detection rate)\n 1/84 Antivirus vendors marked dropped file \"libssp-0.dll\" as malicious (1% detection rate)\n 1/85 Antivirus vendors marked dropped file \"libgcc_s_sjlj-1.dll\" as malicious (1% detection rate)\n 1/85 Antivirus vendors marked dropped file \"ssleay32.dll\" as malicious (1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"4/67 Antivirus vendors marked spawned process \"\" (PID: 3212) as malicious (classified as \"Trojan.Ransom.Shade\" with 5% detection rate)\n 1/86 Antivirus vendors marked spawned process \"svchost.exe\" (PID: 3000) as malicious (classified as \"Trojan.Heur\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"\" set thread context in remote process \"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe\" (PID 00000c8c)","origin":"API Call","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe\" (Handle: 368)\n \"\" wrote 52 bytes to a remote process \"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe\" (Handle: 368)\n \"\" wrote 4 bytes to a remote process \"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe\" (Handle: 368)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"ReadMe.html\" which has been seen in the context of ransomware (Indicator: README.html)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014786-00003028)\n Spawned process \"\" (UID: 00015663-00003212)\n Spawned process \"svchost.exe\" (UID: 00019889-00003000)\n Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe\"\" (UID: 00025036-00003444)\n Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 1 -w 3000\" (UID: 00025047-00003488)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]}],"incidents":[{"name":"Remote Access","details_count":3,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":17,"imported_dlls_count":105,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":90,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":11,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["sigma","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"5a031a397ca3e1443f70b42b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.Shade","contacted_countries":["AUS","AUT","CAN","DEU","EU","FRA","SWE"],"submit_name":"svchost.exe","analysis_start_time":"2017-11-08T15:50:38+00:00","indicators_count":{"informative":19,"suspicious":30,"malicious":18},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.194.141.58","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"address":"82.195.75.101","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"address":"86.59.119.88","port":443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"address":"86.59.21.38","port":443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"address":"85.214.62.48","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"address":"149.56.45.200","port":9001,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"address":"46.105.63.44","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"address":"193.11.114.43","port":9001,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"address":"178.62.201.15","port":9090,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"address":"91.121.160.215","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"address":"1.1.1.1","port":0,"protocol":"ICMP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]}],"dns_resolutions":[{"domain":"archive.torproject.org","address":"82.195.75.101","country":"Germany","registrar_name":"CSL Computer Service Langenbach GmbH d/b/a joker.com a German GmbH","registrar_organization":"The Tor Project, Inc","registrar_name_servers":"NS1.TORPROJECT.ORG","registrar_creation_date":"2006-10-17T22:02:50+00:00","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"domain":"ip-api.com","address":"185.194.141.58","country":"Germany","registrar_name":"Internet Domain Service BS Corp.","registrar_organization":"Whois Privacy Corp.","registrar_creation_date":"2012-04-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"185.194.141.58:80","url":"/json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json HTTP/1.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0\nAccept-Language: en-us,en;q=0.5\nAccept-Encoding: gzip\nHost: ip-api.com","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}],"processes":[{"pid":3028,"ppid":0,"name":"8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe","command_line":"","sha256":"8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1","normalized_path":"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe","uid":"00014786-00003028","icon":"$2f"},{"pid":3212,"ppid":3028,"name":"8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe","command_line":"","sha256":"8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1","normalized_path":"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe","parent_uid":"00014786-00003028","uid":"00015663-00003212","icon":"$30"},{"pid":3000,"ppid":3212,"name":"svchost.exe","command_line":"","sha256":"bfea9e5a4cb7b012454b24c5d76b4bbfdd92fd3a367c438ddf47ed81f618f8f1","normalized_path":"%APPDATA%\\Microsoft\\49713BE301EAE5E8DF52649AB3F90768\\Tor\\svchost.exe","parent_uid":"00015663-00003212","uid":"00019889-00003000","icon":"$31"},{"pid":3368,"ppid":3212,"name":"iexplore.exe","command_line":"-nohome","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00015663-00003212","uid":"00024995-00003368","icon":"$32"},{"pid":3388,"ppid":3368,"name":"iexplore.exe","command_line":"SCODEF:3368 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00024995-00003368","uid":"00025025-00003388","icon":"$33"},{"pid":3444,"ppid":3212,"name":"cmd.exe","command_line":"/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015663-00003212","uid":"00025036-00003444"},{"pid":3488,"ppid":3444,"name":"PING.EXE","command_line":"ping 1.1.1.1 -n 1 -w 3000","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00025036-00003444","uid":"00025047-00003488"}],"all_imported_dlls":["oleaccrc.dll","cscapi.dll","ieproxy.dll","msxml3.dll","oleaut32.dll","setupapi.dll","cryptbase.dll","version.dll","shfolder.dll","ws2_32.dll","imageres.dll","KernelBase.dll","ntmarta.dll","WSHTCPIP.DLL","ieframe.dll","msimg32.dll","winrnr.dll","npmproxy.dll","slc.dll","gdi32.dll","oleacc.dll","msasn1.dll","sspicli.dll","ExplorerFrame.dll","ntshrui.dll","linkinfo.dll","winbrand.dll","msvcrt.dll","shlwapi.dll","comctl32.dll","System.dll","dnsapi.dll","IconCodecService.dll","kernel32.dll","rpcrt4.dll","rsaenh.dll","mswsock.dll","libevent-2-0-5.dll","RpcRtRemote.dll","sqmapi.dll","pnrpnsp.dll","usp10.dll","msctf.dll","profapi.dll","apphelp.dll","propsys.dll","dwmapi.dll","netutils.dll","ssleay32.dll","sechost.dll","ole32.dll","uxtheme.dll","nsi.dll","urlmon.dll","WindowsCodecs.dll","rtutils.dll","nlaapi.dll","devobj.dll","Wldap32.dll","cryptsp.dll","crypt32.dll","wkscli.dll","rasadhlp.dll","netprofm.dll","url.dll","wship6.dll","advapi32.dll","netapi32.dll","libssp-0.dll","dhcpcsvc.dll","SensApi.dll","ONBTTN~1.DLL","clbcatq.dll","IPHLPAPI.DLL","msxml3r.dll","dui70.dll","shell32.dll","dhcpcsvc6.dll","xmllite.dll","duser.dll","EhStorShell.dll","user32.dll","imm32.dll","userenv.dll","cfgmgr32.dll","rasapi32.dll","IEShims.dll","winnsi.dll","tzres.dll","wininet.dll","libeay32.dll","rpcss.dll","rasman.dll","ieui.dll","NapiNSP.dll","ntdll.dll","srvcli.dll","FWPUCLNT.DLL","iertutil.dll","zlib1.dll","wshqos.dll","lpk.dll","psapi.dll","libgcc_s_sjlj-1.dll","comdlg32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"tor.exe","sha256":"bfea9e5a4cb7b012454b24c5d76b4bbfdd92fd3a367c438ddf47ed81f618f8f1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"libevent_extra-2-0-5.dll","sha256":"dbc8a9a2cb33940283078e6d7b767499743e1988479482c7d54d435e943de158","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"tor-gencert.exe","sha256":"0dde189b6b3a19cef666bc6454964b601699a64d9fda3b3c895f4171455cbc42","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"libevent-2-0-5.dll","sha256":"d1ee97282a2ddfcbd7cc6f45f8278c56bfcc3896b05c4f5ebbc5e5d7d4a897b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"libgcc_s_sjlj-1.dll","sha256":"4438b384066ae07fb9537ba948c020323d03d53e197ac6c3629a135f3a44cd27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"libssp-0.dll","sha256":"f5489fb8b5229424ddbd8f38bb93d9a950d029d9d3f36fc1e531086819061cd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"zlib1.dll","sha256":"dbf9926c56f4fd53418e7e078cc6fb0e23f056e2035c09ae9b1ba236306de44e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"System.dll","sha256":"904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"libeay32.dll","sha256":"fe5d316c59ac5b663741d70a922818129275071d1f2b83339059e488e6d9a7b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"libevent_core-2-0-5.dll","sha256":"5f057c50bdd22e4d481cf033984d66b9ab7b79e7388a8a928d8a048e08f40386","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"ssleay32.dll","sha256":"aa7db86c6995ab0c38d88b910484c1cda6f318bc9b82f3123cd65743ab3efd55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"cached-certs.tmp","sha256":"2aa58a35811ee1dabd659e23d1a1f1bba191bae7ff49fbd11e056f07cb745019","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"cached-microdesc-consensus.tmp","sha256":"9f3963d693bc2a2edd8a61d643b9e50f5d7a73d87c4c0f4006cfa8c482f2cbe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"cached-microdescs.new","sha256":"cdc1221a501e813c38ac9278013972cd13e5c781b6462d847f1cb6f79869fdfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"geoip","sha256":"7089d533bb1ffc3066e11f14e39e88bd5dec48cb17edfdb0d96a943bdb88e076","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"geoip6","sha256":"62aa48f57397902b2ee8e0e9abcc98237c70699a956cf0436cc187a4a8ce4618","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"state.tmp","sha256":"cedb725b09d1e3decaa0f18b5442ed242d36b28855da1cc32633c0bee8205cec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"unverified-microdesc-consensus.tmp","sha256":"9f3963d693bc2a2edd8a61d643b9e50f5d7a73d87c4c0f4006cfa8c482f2cbe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"RecoveryStore.{1F55AAF3-C4E0-11E7-9134-0A00278A8F8C}.dat","sha256":"a02cbe72ccc441110bc5c06187d25f5e63c645c43e6c7ce4595e7dd430104ea5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"{1F55AAF4-C4E0-11E7-9134-0A00278A8F8C}.dat","sha256":"d31e3a8063312431eeb52f492e90b7642eda9562f40f011dd516c1b659255e11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"frameiconcache.dat","sha256":"5d3e87b3428bcf68acf0302211e719a6126c6c825281e26511f67ccb463a4158","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"886045802","sha256":"27d73478b29285f5ea7246eafba09afb34080ffb369ed759a7471cafc21ce479","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]}],"files_written":[{"path":"%TEMP%\\nse47D9.tmp","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%TEMP%\\nsv4853.tmp","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%TEMP%\\886045802","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%TEMP%\\nsv4853.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft\\49713BE301EAE5E8DF52649AB3F90768\\taskwgr.exe","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"C:\\8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft\\49713BE301EAE5E8DF52649AB3F90768\\taskwgr.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\lock","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\router-stability","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\geoip","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\geoip6","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\cached-certs","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\cached-consensus","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\unverified-consensus","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\cached-microdesc-consensus","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\cached-microdescs","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\cached-descriptors","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\cached-extrainfo","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\unverified-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\cached-certs.tmp","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\cached-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\cached-microdescs.new","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"C:\\Users\\prmGrvU","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\url.dll","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\frameiconcache.dat","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBttnIE.dll","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBTTN~1.DLL","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%USERPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%USERPROFILE%\\Favorites\\Links","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%TEMP%\\~DF700C99F2A82506B3.TMP","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{1F55AAF4-C4E0-11E7-9134-0A00278A8F8C}.dat","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%TEMP%\\~DFE1BC5451867D6B27.TMP","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{1F55AAF3-C4E0-11E7-9134-0A00278A8F8C}.dat","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"path":"%APPDATA%\\tor\\state.tmp","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!prmgrvu!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!prmgrvu!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<3368>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!prmgrvu!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!prmgrvu!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a031a397ca3e1443f70b42b"}]}]}},"report_ids":{"sandbox_job_ids":["5a031a397ca3e1443f70b42b"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 8d54dbe841c9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8d54dbe841c9…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 8d54dbe841c9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8d54dbe841c9…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8d54dbe841c95ba67549e8e28a4fbddbf87032e8736f01ec5a4563d3f7e6bfe1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 8d54dbe841c9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8d54dbe841c9…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]