26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.DarkBit Sample 9107be160f7b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9107be160f7b…. Malware family: Trojan.Ransom.DarkBit. Threat score 100/100. 20/25 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff","keywords":["Malicious","Trojan.Ransom.DarkBit","malware analysis","sandbox report","threat intelligence","9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"],"about":{"@type":"SoftwareApplication","name":"8thcurse.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.DarkBit","antivirusDetections":{"malicious":20,"total":25},"behavioralIndicators":{"malicious":8,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tf76,".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\Jd9Bs9A11676413298.Darkbit" at 00000000-00003032-00000046-16191753 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\HCEHrwRi1676413298.Darkbit" at 00000000-00003032-00000046-16215646 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\W019GC3F1676413299.Darkbit" at 00000000-00003032-00000046-16238654 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\MzJNvQoV1676413299.Darkbit" at 00000000-00003032-00000046-16269249 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\adb8jwjz1676413299.Darkbit" at 00000000-00003032-00000046-16295215 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\krheQaWO1676413300.Darkbit" at 00000000-00003032-00000046-16691339 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\x0OLigGu1676413300.Darkbit" at 00000000-00003032-00000046-16866731 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\mziyp2Mg1676413300.Darkbit" at 00000000-00003032-00000046-16900641 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\ir3ctcZY1676413300.Darkbit" at 00000000-00003032-00000046-16953777 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\PFloAoB51676413300.Darkbit" at 00000000-00003032-00000046-16973168 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\amzC1rc51676413300.Darkbit" at 00000000-00003032-00000046-16992240 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\u9gq7ptL1676413300.Darkbit" at 00000000-00003032-00000046-17013372 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\jnackJMi1676413300.Darkbit" at 00000000-00003032-00000046-17061027 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\bpFOoCh71676413301.Darkbit" at 00000000-00003032-00000046-17155216 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\zWek7Tan1676413301.Darkbit" at 00000000-00003032-00000046-17191338 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\LTETjVzX1676413301.Darkbit" at 00000000-00003032-00000046-17243309 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\DkVGDWMt1676413301.Darkbit" at 00000000-00003032-00000046-17290692 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\1wg4G63J1676413301.Darkbit" at 00000000-00003032-00000046-17315951 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\bnCPW51K1676413301.Darkbit" at 00000000-00003032-00000046-17350351 ".exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\XU1Tdeu21676413301.Darkbit" at 00000000-00003032-00000046-1740245828:Te79,"TxnZgBAW1676413252.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DOMStore\O2FDR7TK\TxnZgBAW1676413252.Darkbit]- [targetUID: 00000000-00003032] "RECOVERY_DARKBIT.txt" has type "UTF-8 Unicode text"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\9DCW73ON\RECOVERY_DARKBIT.txt]- [targetUID: 00000000-00003032] "70QnN6Rd1676413255.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DOMStore\O2FDR7TK\70QnN6Rd1676413255.Darkbit]- [targetUID: 00000000-00003032] "AM10Wmzn1676413611.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\98FKNM2M\AM10Wmzn1676413611.Darkbit]- [targetUID: 00000000-00003032] "3Hvz2LsQ1676413362.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0CH0OVJV\3Hvz2LsQ1676413362.Darkbit]- [targetUID: 00000000-00003032] "UDU8OTEd1676413245.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DOMStore\22TFNG51\UDU8OTEd1676413245.Darkbit]- [targetUID: 00000000-00003032] "qtcecgtK1676413375.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0NGI0OC3\qtcecgtK1676413375.Darkbit]- [targetUID: 00000000-00003032] "b5rqWomN1676413499.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\3K0JAKI5\b5rqWomN1676413499.Darkbit]- [targetUID: 00000000-00003032] "fd9np2wR1676413427.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\3IQVUB7J\fd9np2wR1676413427.Darkbit]- [targetUID: 00000000-00003032] "k83BTwut1676413626.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\9DCW73ON\k83BTwut1676413626.Darkbit]- [targetUID: 00000000-00003032] "MddzuaOD1676413399.Darkbit" has type "PGP Secret Sub-key -"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1C8Y98H0\MddzuaOD1676413399.Darkbit]- [targetUID: 00000000-00003032] "Jq8gAntz1676413440.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\3IQVUB7J\Jq8gAntz1676413440.Darkbit]- [targetUID: 00000000-00003032] "aJIn3Oq01676413394.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1C8Y98H0\aJIn3Oq01676413394.Darkbit]- [targetUID: 00000000-00003032] "yzQnKYqD1676413502.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\3K0JAKI5\yzQnKYqD1676413502.Darkbit]- [targetUID: 00000000-00003032] "fK0cZunJ1676413372.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\0NGI0OC3\fK0cZunJ1676413372.Darkbit]- [targetUID: 00000000-00003032] "M4dvYXSG1676413551.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\4KBMQIHU\M4dvYXSG1676413551.Darkbit]- [targetUID: 00000000-00003032] "8FIV6MKc1676413498.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\3K0JAKI5\8FIV6MKc1676413498.Darkbit]- [targetUID: 00000000-00003032] "SY0t4lsv1676413433.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\3IQVUB7J\SY0t4lsv1676413433.Darkbit]- [targetUID: 00000000-00003032] "p0QP02HF1676413619.Darkbit" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\98FKNM2M\p0QP02HF1676413619.Darkbit]- [targetUID: 00000000-00003032]29:T98c,".exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" ".exe" touched file "C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Local\Microsoft\Windows\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Local\Microsoft\Windows\History\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\RECOVERY_DARKBIT.txt" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\1033\RECOVERY_DARKBIT.txt"2a:T441,Dropped file: "gortGCRw1676413240.Darkbit" - Location: [%APPDATA%\Microsoft\Internet Explorer\Quick Launch\gortGCRw1676413240.Darkbit]- [targetUID: 00000000-00003032] Dropped file: "CoKiXHIC1676413240.Darkbit" - Location: [%APPDATA%\Microsoft\Internet Explorer\Quick Launch\CoKiXHIC1676413240.Darkbit]- [targetUID: 00000000-00003032] Dropped file: "jmigkEYz1676413241.Darkbit" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\jmigkEYz1676413241.Darkbit]- [targetUID: 00000000-00003032] Dropped file: "2wTogyvq1676413241.Darkbit" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\2wTogyvq1676413241.Darkbit]- [targetUID: 00000000-00003032] Dropped file: "i3CDw3Mw1676413241.Darkbit" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\i3CDw3Mw1676413241.Darkbit]- [targetUID: 00000000-00003032] Dropped file: "RnYAADgM1676413241.Darkbit" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\RnYAADgM1676413241.Darkbit]- [targetUID: 00000000-00003032]2b:T883,"Dear Colleagues, Were sorry to inform you that weve had to hack Technion network completely and transfer all data to our secure servers. So, keep calm, take a breath and think about an apartheid regime that causes troubles here and there. They should pay for their lies and crimes, their names and shames. They should pay for occupation, war crimes against humanity, killing the people (not only Palestinians bodies, but also Israelis souls) and destroying the future and all dreams we had. They should pay for firing high-skilled experts. Anyway, there is nothing for you (as an individual) to be worried. Thats the task of the administration to follow up our instruction for recovering the network. But, you can contact us via TOX messenger if you want to recover your files personally. (TOX ID: AB33BC51AFAC64D98226826E70B483593C81CB22E6A3B504F7A75348C38C862F00042F5245AC) Our instruction for the administration: All your files are encrypted using AES-256 military grade algorithm. So, 1. Don't try to recover data, because the encrypted files are unrecoverable unless you have the key. Any try for recovering data without the key (using third-party applications/companies) causes PERMANENT damage. Take it serious. 2. You have to trust us. This is our business (after firing from high-tech companies) and the reputation is all we have. 3. All you need to do is following up the payment procedure and then you will receive decrypting key using for returning all of your files and VMs. 4. Payment method: Enter the link below http://iw6v2p3cruy7tqfup3yl4dgt4pfibfa3ai4zgnu5df2q3hus3lm7c7ad.onion/support Enter the ID below and pay the bill (80 BTC) dabda-bt2as4dfa-294jfajks-qti9-bm3xu2 You will receive decrypting key after the payment. Notice that you just have 48 hours. After the deadline, a 30% penalty will be added to the price. We put data for sale after 5 days. Take it serious and dont listen to probable advices of a stupid government. Good Luck! DarkBit" (Source: RECOVERY_DARKBIT.txt, Indicator: "files are encrypted") "All your files are encrypted using AES-256 military grade algorithm. So," (Source: RECOVERY_DARKBIT.txt, Indicator: "files are encrypted")2c:Tb38,".exe" opened "Z:\network.pcapng" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.gazeta[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.homedepot[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.ibm[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.kohls[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.lightboxcdn[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.meituan[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.mlb[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.mobile[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.mp3raid[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.nationalgeographic[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.next.co[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.ning[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.ojogos.com[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.overstock[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.retailmenot[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.rtl[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.sdo[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.theweathernetwork[1].xml" with delete access ".exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\DOMStore\PU4P3OOW\www.walmart[1].xml" with delete access2d:T4ce,"8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-11652220 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-11657770 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-11982253 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-11983268 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-11985817 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-11986504 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-11997755 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-11998557 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-12053801 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-12054382 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-12074998 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-12075605 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-12077402 "8thcurse.exe" queried SystemProcessInformation at 00000000-00006728-00000036-120779612e:T6f4,"8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\vZtmOlJX1676232789.Darkbit" (Type: "FileHandle") "8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\A00BwFmX1676232786.Darkbit" (Type: "FileHandle") "8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\BfkAqI9T1676232790.Darkbit" (Type: "FileHandle") "8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\oOdSTbJW1676232787.Darkbit" (Type: "FileHandle") "8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\mUBmJkoN1676232788.Darkbit" (Type: "FileHandle") "8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\qKQFeiwg1676232790.Darkbit" (Type: "FileHandle") "8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\u1QS0hQR1676232786.Darkbit" (Type: "FileHandle") "8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\kf44vUTY1676232786.Darkbit" (Type: "FileHandle") "8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\xjAs9RzN1676232789.Darkbit" (Type: "FileHandle") "8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\FEc0N65m1676232786.Darkbit" (Type: "FileHandle") "8thcurse.exe" had access to "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\9VrlFPhA1676232790.Darkbit" (Type: "FileHandle")2f:Te03,"8thcurse.exe" wrote bytes "3d82f56b31d40000" to virtual address "0xF17024D0" (part of module "NTDLL.DLL") "8thcurse.exe" wrote bytes "b001ecedfd7f0000" to virtual address "0xF14871A8" (part of module "RPCRT4.DLL") "8thcurse.exe" wrote bytes "c0ce1cf0fd7f000000501ff0fd7f0000c07c1ff0fd7f0000c0f21cf0fd7f0000" to virtual address "0xEE964320" (part of module "KERNELBASE.DLL") "8thcurse.exe" wrote bytes "90131ef0fd7f000000491df0fd7f000050711df0fd7f0000f0011ef0fd7f0000" to virtual address "0xEE9642E0" (part of module "KERNELBASE.DLL") "8thcurse.exe" wrote bytes "50581df0fd7f000000571df0fd7f0000" to virtual address "0xEE964390" (part of module "KERNELBASE.DLL") "8thcurse.exe" wrote bytes "e0e41ff0fd7f000040eb1cf0fd7f000000f11df0fd7f000090ef1cf0fd7f000050e51df0fd7f000080c81cf0fd7f000010d91cf0fd7f000050af1df0fd7f000050ed1df0fd7f000070ce1cf0fd7f000070e71df0fd7f0000" to virtual address "0xEE964410" (part of module "KERNELBASE.DLL") "8thcurse.exe" wrote bytes "a09dd4edfd7f0000608ed4edfd7f000090b7d2edfd7f0000a090d4edfd7f0000508dd2edfd7f0000502ed2edfd7f000020c4d4edfd7f000070bbd4edfd7f000080bcd4edfd7f00004078d5edfd7f0000a0bad4edfd7f00000088d4edfd7f0000" to virtual address "0xF11A4030" (part of module "GDI32.DLL") "8thcurse.exe" wrote bytes "a07122f0fd7f0000d0121df0fd7f0000b0371ef0fd7f000020191df0fd7f000090fe1cf0fd7f000020191df0fd7f000020191df0fd7f0000407122f0fd7f0000e01c1df0fd7f0000e01c1df0fd7f0000" to virtual address "0xEE964288" (part of module "KERNELBASE.DLL") "8thcurse.exe" wrote bytes "403b1df0fd7f0000507522f0fd7f000010871cf0fd7f0000e07622f0fd7f0000207822f0fd7f000040031ef0fd7f0000207622f0fd7f000040381df0fd7f0000" to virtual address "0xEE964348" (part of module "KERNELBASE.DLL") "8thcurse.exe" wrote bytes "70141cf0fd7f0000001e1cf0fd7f0000" to virtual address "0xEE964308" (part of module "KERNELBASE.DLL") "8thcurse.exe" wrote bytes "f0ef1cf0fd7f0000d0c21cf0fd7f000030731cf0fd7f0000d0e91cf0fd7f000020e21cf0fd7f0000d0ad1df0fd7f000010071ef0fd7f0000d0bf1cf0fd7f0000e00622f0fd7f000000c01cf0fd7f000080cd1cf0fd7f000080eb1cf0fd7f0000" to virtual address "0xEE9643A8" (part of module "KERNELBASE.DLL") "vssadmin.exe" wrote bytes "962a960c2a0f0000" to virtual address "0xF17024D0" "vssadmin.exe" wrote bytes "b001ecedfd7f0000" to virtual address "0xF14871A8" (part of module "RPCRT4.DLL") "vssadmin.exe" wrote bytes "50581df0fd7f000000571df0fd7f0000" to virtual address "0xEE964390" (part of module "KERNELBASE.DLL") "vssadmin.exe" wrote bytes "e0e41ff0fd7f000040eb1cf0fd7f000000f11df0fd7f000090ef1cf0fd7f000050e51df0fd7f000080c81cf0fd7f000010d91cf0fd7f000050af1df0fd7f000050ed1df0fd7f000070ce1cf0fd7f000070e71df0fd7f0000" to virtual address "0xEE964410" (part of module "KERNELBASE.DLL") "vssadmin.exe" wrote bytes "a01c5cf0fd7f0000601c5cf0fd7f0000d01b5cf0fd7f0000" to virtual address "0xF0568430" (part of module "COMBASE.DLL") "vssadmin.exe" wrote bytes "a09dd4edfd7f0000608ed4edfd7f000090b7d2edfd7f0000a090d4edfd7f0000508dd2edfd7f0000502ed2edfd7f000020c4d4edfd7f000070bbd4edfd7f000080bcd4edfd7f00004078d5edfd7f0000a0bad4edfd7f00000088d4edfd7f0000" to virtual address "0xF11A4030" (part of module "GDI32.DLL") "vssadmin.exe" wrote bytes "202e95edfd7f0000302e95edfd7f0000" to virtual address "0xF0568378" (part of module "COMBASE.DLL") "vssadmin.exe" wrote bytes "c0ce1cf0fd7f000000501ff0fd7f0000c07c1ff0fd7f0000c0f21cf0fd7f0000" to virtual address "0xEE964320" (part of module "KERNELBASE.DLL") "vssadmin.exe" wrote bytes "90131ef0fd7f000000491df0fd7f000050711df0fd7f0000f0011ef0fd7f0000" to virtual address "0xEE9642E0" (part of module "KERNELBASE.DLL")30:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790310818599,"unified_at":"2026-09-25T04:33:38.599Z","metadata":{"hashes":{"sha256":"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff","sha1":"30466ccd4ec7bcafb370510855da2cd631f74b7a","md5":"9880fae6551d1e9ee921f39751a6f3c0","sha512":"c38b5c7fc6f0089e6b0318ff63b4053f9015f7d71c19545e1e3bcbfda2f314f628897f2033360f29a459efa701fb0a12b546239d1a1e7b12fb51ebe6f0407b4b","ssdeep":"49152:S4mkYp+03HbhndpeoVK9/0cjXd77yg6PxHuy7vDKD12K5EKGHg1q14gUynCLgIMk:UF31ed/XB7AbvbAEKGpTI7","ssdeep_chunks":["49152:S4mkYp+","49152:4mkYp+0","49152:mkYp+03","49152:kYp+03H","49152:Yp+03Hb","49152:p+03Hbh","49152:+03Hbhn","49152:03Hbhnd","49152:3Hbhndp","49152:Hbhndpe","49152:bhndpeo","49152:hndpeoV","49152:ndpeoVK","49152:dpeoVK9","49152:peoVK9/","49152:eoVK9/0","49152:oVK9/0c","49152:VK9/0cj","49152:K9/0cjX","49152:9/0cjXd","49152:/0cjXd7","49152:0cjXd77","49152:cjXd77y","49152:jXd77yg","49152:Xd77yg6","49152:d77yg6P","49152:77yg6Px","49152:7yg6PxH","49152:yg6PxHu","49152:g6PxHuy","49152:6PxHuy7","49152:PxHuy7v","49152:xHuy7vD","49152:Huy7vDK","49152:uy7vDKD","49152:y7vDKD1","49152:7vDKD12","49152:vDKD12K","49152:DKD12K5","49152:KD12K5E","49152:D12K5EK","49152:12K5EKG","49152:2K5EKGH","49152:K5EKGHg","49152:5EKGHg1","49152:EKGHg1q","49152:KGHg1q1","49152:GHg1q14","49152:Hg1q14g","49152:g1q14gU","49152:1q14gUy","49152:q14gUyn","49152:14gUynC","49152:4gUynCL","49152:gUynCLg","49152:UynCLgI","49152:ynCLgIM","49152:nCLgIMk","98304:S4mkYp+","98304:4mkYp+0","98304:mkYp+03","98304:kYp+03H","98304:Yp+03Hb","98304:p+03Hbh","98304:+03Hbhn","98304:03Hbhnd","98304:3Hbhndp","98304:Hbhndpe","98304:bhndpeo","98304:hndpeoV","98304:ndpeoVK","98304:dpeoVK9","98304:peoVK9/","98304:eoVK9/0","98304:oVK9/0c","98304:VK9/0cj","98304:K9/0cjX","98304:9/0cjXd","98304:/0cjXd7","98304:0cjXd77","98304:cjXd77y","98304:jXd77yg","98304:Xd77yg6","98304:d77yg6P","98304:77yg6Px","98304:7yg6PxH","98304:yg6PxHu","98304:g6PxHuy","98304:6PxHuy7","98304:PxHuy7v","98304:xHuy7vD","98304:Huy7vDK","98304:uy7vDKD","98304:y7vDKD1","98304:7vDKD12","98304:vDKD12K","98304:DKD12K5","98304:KD12K5E","98304:D12K5EK","98304:12K5EKG","98304:2K5EKGH","98304:K5EKGHg","98304:5EKGHg1","98304:EKGHg1q","98304:KGHg1q1","98304:GHg1q14","98304:Hg1q14g","98304:g1q14gU","98304:1q14gUy","98304:q14gUyn","98304:14gUynC","98304:4gUynCL","98304:gUynCLg","98304:UynCLgI","98304:ynCLgIM","98304:nCLgIMk","49152:UF31ed/","49152:F31ed/X","49152:31ed/XB","49152:1ed/XB7","49152:ed/XB7A","49152:d/XB7Ab","49152:/XB7Abv","49152:XB7Abvb","49152:B7AbvbA","49152:7AbvbAE","49152:AbvbAEK","49152:bvbAEKG","49152:vbAEKGp","49152:bAEKGpT","49152:AEKGpTI","49152:EKGpTI7"],"imphash":"9bcadd8ed34a63728178995d1b006421"},"file_info":{"file_name":"8thcurse.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":5385216,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1676232409000,"last_seen":1726460062000,"last_multi_scan":1726460062000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["DarkBit","ransomware","exploit"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":25},"sandbox_signatures":{"informative_count":39,"suspicious_count":17,"malicious_count":8,"total":64},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Ransomware/Win.DARKBIT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win32.Obfuscated","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.toxmq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.DarkBit.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_Win64_DarkBit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.DarkBit.A (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"WinGo/Filecoder.DarkBit.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:HackTool/Sliver.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0058e3dd1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-darkbit.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.DelShad.jurwtc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DarkBit-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W64.DarkBit.5385216","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/DarkBit.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agent.IG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.DelShad","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.DelShad.Win32.1978","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.DarkBit","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"suspicious","value":"Accesses potentially sensitive information from local browsers"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - Possible RC4 Encryption"},{"type":"informative","value":"YARA signature match - Possible AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Impact","technique":"Inhibit System Recovery","attack_id":"T1490","attack_id_wiki":"https://attack.mitre.org/techniques/T1490","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"vssadmin.exe\" at 00000000-00003064-00000033-13666648","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003032)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003032)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\"vssadmin.exe\" called \"LookupAccountSidW\" with parameter \"HAPUBWS\" - (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessW\" with parameter \"vssadmin.exe delete shadows /all /Quiet\" - (UID: 00000000-00003032)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin)","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" contains export function called \"_cgo_dummy_export\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\dbdbdbdb\"\n \"Global\\dbdbdbdb\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"vssadmin.exe\" touched \"VSSCoordinator Class\" (Path: \"HKCU\\CLSID\\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\\PROGID\")\n \"vssadmin.exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{F2C2787D-95AB-40D4-942D-298F5F757874}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" has an writable section named \".data\"\n \"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" has an writable section named \".bss\"\n \"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" has an writable section named \".idata\"\n \"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" has an writable section named \".CRT\"\n \"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" has an writable section named \".tls\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" file has an entrypoint instructions - \"subrsp, 0x28,movrax, qword ptr [rip + 0x519735],movdword ptr [rax], 0,call0x737200,call0x4011b0,nop,nop,addrsp, 0x28,ret,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,pushrbp,movrbp, rsp,poprbp,ret,nopword ptr cs:[rax + rax],pushrbp,movrbp, rsp,subrsp, 0x20,cmpqword ptr [rip + 0x3571d0], 0,je0x401582,learcx, [rip + 0x357aa7],callqword ptr [rip + 0x57de5d],testrax, rax,je0x401593,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x337a00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x1c2200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x3378e0\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x1c20f0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"vssadmin.exe\" with commandline \"delete shadows /all /Quiet\" (UID: 00000000-00003064)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"vssadmin.exe\" with commandline \"delete shadows /all /Quiet\" (UID: 00000000-00003064)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" (Offset: 356553)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$28","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"\".exe\" trying to access non-existent file \"%WINDIR%\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"%WINDIR%\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\cryptbase.dll\"\n \".exe\" trying to access non-existent file \"Z:\\network.pcapng\"\n \".exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"vssadmin.exe\" trying to access non-existent file \"%WINDIR%\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \"vssadmin.exe\" trying to access non-existent file \"%WINDIR%\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \"vssadmin.exe\" trying to access non-existent file \"%WINDIR%\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"vssadmin.exe\" trying to access non-existent file \"%WINDIR%\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Network Related","name":"Contains Tor Onion URL","description":"\"http://iw6v2p3cruy7tqfup3yl4dgt4pfibfa3ai4zgnu5df2q3hus3lm7c7ad.onion/support\" (Indicator: \"http://iw6v2p3cruy7tqfup3yl4dgt4pfibfa3ai4zgnu5df2q3hus3lm7c7ad.onion/support\") in Source: RECOVERY_DARKBIT.txt","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"*runtime.name\"\n Heuristic match: \"$Dw>=%W.cy\"\n Heuristic match: \"runtime.(*functype).in\"\n Heuristic match: \"runtime.(*bucket).mp\"\n Heuristic match: \"runtime.(*pollDesc).info\"\n Heuristic match: \"runtime.name.name\"\n Heuristic match: \"FVP5c0D3z.(*ukAo4jrjCF0Aqd).Name\"\n Heuristic match: \"klOM9UE_tW2XC.(*DCH0OR_xRbbl8).Do\"\n Heuristic match: \"reflect.(*rtype).Name\"\n Heuristic match: \"reflect.(*rtype).In\"\n Heuristic match: \"reflect.NPXDf1tjXXdq.Int\"\n Pattern match: \"www.macromedia.com\\*\"\n Pattern match: \"www.macromedia.com\\bin\\airappinstaller\\*\"\n Pattern match: \"http://iw6v2p3cruy7tqfup3yl4dgt4pfibfa3ai4zgnu5df2q3hus3lm7c7ad.onion/support\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Possible AES Encryption","description":"Internal YARA signature for possible AES encryption matched on file \"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Possible RC4 Encryption","description":"Internal YARA signature for possible RC4 encryption matched on file \"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\".exe\" called \"FindFirstFileW\" (UID: 00000000-00003032)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"vssadmin.exe\" called an API \"AdjustTokenPrivileges\"","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$2a","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"44/71 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 3733248)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 4286854656)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a file to the start menu","description":"\"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe\" wrote to file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\jmigkEYz1676413241.Darkbit\"\n \"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe\" wrote to file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\2wTogyvq1676413241.Darkbit\"\n \"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe\" wrote to file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\i3CDw3Mw1676413241.Darkbit\"\n \"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe\" wrote to file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\RnYAADgM1676413241.Darkbit\"","origin":"API Call","relevance":10,"id":"api-53","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2b","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003032)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\".exe\" opened file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\"","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" has a TLS callback with entrypoint at 0x737410","origin":"Static Parser","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemInfo\n LoadLibraryW\n VirtualProtect\n LoadLibraryA\n GetSystemDirectoryA\n OpenProcess\n UnhandledExceptionFilter\n GetProcAddress\n GetThreadContext\n CreateThread\n GetModuleHandleA\n GetStartupInfoA\n TerminateProcess\n WriteFile\n Sleep\n CreateFileA\n GetTickCount\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"WSAIoctl\" (Source: 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin, API is part of module: WS2_32.DLL)\n Found string \"GetFileType\" (Source: 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileInformationByHandle\" (Source: 9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.bin\" has a section named \".CRT\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"44/71 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 288)\n \".exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 288)\n \".exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 288)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"delete shadows /all /Quiet\" (UID: 00000000-00003064)","origin":"Monitored Target","mitre_attack_id":"T1490","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\".exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"8thcurse.exe\" called \"EnumWindows\" with parameter \"1794837064\" - (UID: 00000000-00006728)","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"8thcurse.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006728)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\conhost.exe\" [Source: 00000000-00006728-00000BC0-73631877]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"8thcurse.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\bYZVUykF1676232777.Darkbit\"\n \"8thcurse.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\zxJ56P2Y1676232777.Darkbit\"\n \"8thcurse.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\4GLyDrWh1676232777.Darkbit\"\n \"8thcurse.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\4GLyDrWh1676232777.Darkbit\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$2d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"1.0.0.8\" found in string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\AutoLaunchProtocolsComponent\\1.0.0.8\\*\"\n Potential IP \"3.0.0.3\" found in string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Autofill\\3.0.0.3\\*\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"$2e","origin":"Touched Handle","mitre_attack_id":"T1005","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"8thcurse.exe\" called \"GetDriveTypeW\" (UID: 00000000-00006728)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2f","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Requested allocation of the NULL page (often part of preparing kernel exploit)","description":"\"8thcurse.exe\" requested allocation of a NULL page","origin":"API Call","relevance":10,"id":"api-87","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"8thcurse.exe\" allocated memory in \"%WINDIR%\\System32\\ntasn1.dll\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"Detected indicator that file is ransomware"},{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":54,"dropped_files_count":0,"extracted_files_count":40,"files_written_count":153,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":6,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["DarkBit","ransomware","exploit"],"sample_flags":["Extracted Files","User Comment"],"sandbox_reports":[{"id":"63ec16907a108208ba0525e5","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe","analysis_start_time":"2023-02-14T23:17:37+00:00","indicators_count":{"informative":34,"suspicious":12,"malicious":7},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"63e946d8f169391d2b119bea","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"8thcurse.exe","analysis_start_time":"2023-02-12T20:06:52+00:00","indicators_count":{"informative":34,"suspicious":15,"malicious":6},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}],"processes":[{"pid":3032,"ppid":0,"name":"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe","command_line":"","sha256":"9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff","normalized_path":"C:\\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe","uid":"00000000-00003032","icon":"$30"},{"pid":3064,"ppid":3032,"name":"vssadmin.exe","command_line":"delete shadows /all /Quiet","sha256":"4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","normalized_path":"%WINDIR%\\system32\\vssadmin.exe","parent_uid":"00000000-00003032","uid":"00000000-00003064"}],"all_imported_dlls":["cfgmgr32.dll","tzres.dll","atl.dll","ntdll.dll","msvcrt.dll","lpk.dll","winmm.dll","gdi32.dll","ws2_32.dll","rpcss.dll","vssapi.dll","rsaenh.dll","setupapi.dll","fltLib.dll","sechost.dll","api-ms-win-core-synch-l1-2-0.dll","devobj.dll","apphelp.dll","VxSSL64.dll","cryptsp.dll","imm32.dll","msctf.dll","powrprof.dll","vss_ps.dll","KernelBase.dll","rpcrt4.dll","user32.dll","usp10.dll","ole32.dll","nsi.dll","WSHTCPIP.DLL","wship6.dll","kernel32.dll","cryptbase.dll","wshqos.dll","oleaut32.dll","clbcatq.dll","vsstrace.dll","RpcRtRemote.dll","advapi32.dll","msvcp_win.dll","winmmbase.dll","RstrtMgr.dll","gdi32full.dll","combase.dll","bcryptprimitives.dll","shlwapi.dll","ntasn1.dll","ncrypt.dll","uxtheme.dll","win32u.dll","kernel.appcore.dll","ucrtbase.dll","bcrypt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"CoKiXHIC1676413240.Darkbit","sha256":"88ecd88274c9c5ae22ad2678381061456a4dfdf1ab034f42239cecf62a9c9497","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"gortGCRw1676413240.Darkbit","sha256":"bb41d4da93f9ca3ac3efb628ad9fcf4cdc098d37c30759f0a1ef65b3e3453c87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"i3CDw3Mw1676413241.Darkbit","sha256":"2e5198a9a1bf5bf5023724728441e1d94a47dca5eb70ab1950c801a8510fb09a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"jmigkEYz1676413241.Darkbit","sha256":"163229d9597718353a0de8f74074d4c4e05a849f0bc7fe198340ac9160f3faee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"RnYAADgM1676413241.Darkbit","sha256":"cf6abdd8f89854d0e388562156628e22679214f398677c6bf04acce7c3892be2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"2wTogyvq1676413241.Darkbit","sha256":"55742f42aff0d2f06000b936a85819567721d2e0f2d042f0c85603e19ba0eb3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"HXCF3HrY1676413241.Darkbit","sha256":"953475a1b7a6c5853f894d580ccf8271f4c6b9bcf169751af263416445483fee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"a8HwhUfd1676413241.Darkbit","sha256":"482a00329f25f6decd8216dde5bd7bad55bf0c0bb5603c42ead05f11515ddfb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"hciYHDUN1676413241.Darkbit","sha256":"53fc437051e5d8b62d0d116ce930284d50db1c1d4c3d75117308d0633c22c444","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"i3HE7hsQ1676413242.Darkbit","sha256":"92725fc0252c7538df00d114df7aed5936ffa2c77544df0a73215c64c4c74a12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"t9xlG1BU1676413242.Darkbit","sha256":"82ccd3d829802e86eaed1cde4a41217ce43580b5b651b05fdfd43573142640c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"riNo5ZMb1676413242.Darkbit","sha256":"83d7b44c56c6bf1b3b420ef5ea663ba595c9eb4f6645a38b6ba59baffda80ab0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"meEkKDG11676413242.Darkbit","sha256":"dac578943080ec41e84fa11362ee276507595644ae0e4581a38a97a27a161ae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"yJAjGYqP1676413242.Darkbit","sha256":"8a2743b81fac6125b849a97de3ea1f85f179c530ac4d5be11eb485949a6a8803","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"14VhFw4V1676413246.Darkbit","sha256":"e490f18208d0cd916d9d1f2eee730bcdf7f41abfb88339a88b03b41bf5613e4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"1Q7vZBOH1676413244.Darkbit","sha256":"c0b5be49d0d637c07d5208a44ef95a58705ed1351012f491808c59ce5360d901","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"2BZ9Aixo1676413247.Darkbit","sha256":"94e5e544df420dbc51ebbba7633e7a7edf24bf7642ab922904a637f83d84c926","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"2IBANWlQ1676413245.Darkbit","sha256":"4c16a8aff71fc96699748d77038f85f6107123d997d81e41f4c01084e52a45f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"2mczcIvM1676413245.Darkbit","sha256":"74c0575755734c1c9348152e17c2beb303ca054385390f4117bfbf372b4a0bfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"5NSUg3u01676413243.Darkbit","sha256":"b38b43939d779e1a91fd251441925a160f2710d6e40fbd5f264600fcb1ea1cd4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"name":"N56tGq3C1676232774.Darkbit","sha256":"b6327655d43f572b0379beff48b93c7a677a9fbd779327f456bac0e73edaa476","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"s8T8ikxQ1676232774.Darkbit","sha256":"f3cb54dc2e58ff758610ee243c461c8d7cf95cdc98c5e06aca38b147f71f3644","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"BJmWlk271676232774.Darkbit","sha256":"b6b317cd33ef7ab4647ceffada1eddd43d380b2398c69f6a7e926d7482d2d475","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"1UatZWPq1676232774.Darkbit","sha256":"bea26272e6cab7ceca104d2a915331473c054e41cb7dfcdba06b802a8205628c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"F8E4j9iD1676232774.Darkbit","sha256":"698c9b1e68de4b5e763db73e10334bdb03ab61e35544d26765469f334c152046","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"vQBh3LAB1676232774.Darkbit","sha256":"62b04d774d6b9ff2eed90b7cfd2b06c7dc1acbdb37e426b7fe5c2d0758e5dcb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"nKm78R0J1676232774.Darkbit","sha256":"89e12230e52941a83d53f1ae07b2383e8d38172581057270221dda51b778ed83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"PFaquApY1676232774.Darkbit","sha256":"e84b461c93c176715a2fd79a1e01aaaf770fc9688f2d56c0eb0abe5a896bc9ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"BoPZ9Ym61676232774.Darkbit","sha256":"520fde04b584be18658db1a323d680b5c93ee011c3d02970b2b4b82ba86681bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"GBnTMsN11676232774.Darkbit","sha256":"412e63bc9d3211037eca3dcfb8bbb8e899b00e24e7209268245ef22509ed37d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"S1Hcmw421676232774.Darkbit","sha256":"fe8307038e8d79077b5596fa8f34dfe6f1eb1fbdaf32f39e41ebae351450338e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"dfuHYrlb1676232774.Darkbit","sha256":"9386b758ca1a5175eef28aab46f3709df7cb401ba81a283733b178235db09eed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"kSyncevw1676232774.Darkbit","sha256":"3284830c6d82c199ffedc629f38d13e94fc01840177edebc099512c164bb6d39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"2D7ExNwh1676232774.Darkbit","sha256":"d4752dee81ea82aefdb565eb7c364326ce68e9c76dd8faacc4edae40bb60682a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"JUZlRZ1b1676232774.Darkbit","sha256":"3909406799a83495eaa91a77450fddc91cdc43441305adecc6270d8d576dad6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"cEMjGqBi1676232774.Darkbit","sha256":"77ba7cd3bb83c3f8643df26fae6314de7927cc1f578a1169afa3e60709f7d82d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"zEZ33qRN1676232774.Darkbit","sha256":"adc9d084a94c1f03f8dcba12d2c0cc2388d36e969ff70b2a28de92e19089f0ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"5SYtprGO1676232775.Darkbit","sha256":"8bbe074d1523f6f5ee22a61733eea17524e3c190c9f440a7aec32c6fe8574acd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"fgq314nc1676232775.Darkbit","sha256":"f12ce2521aad9dca667001490ae8effc8b0fd4f4a268deb3d9d10dfabfaa8ac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"lDOgxMjl1676232775.Darkbit","sha256":"d5b9f242e0a7734cba98cafbf92e2fe774885810b6b98d6a4e3631c55cc1eed0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]}],"files_written":[{"path":"C:\\share\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\airappinstaller\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Templates\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%USERPROFILE%\\Music\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\Cache\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\CEF\\User Data\\Dictionaries\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Google\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\O2FDR7TK\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\PU4P3OOW\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\EUPP\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Media Player\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\NetTraces\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\ONetConfig\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"C:\\Users\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\ar\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\GameExplorer\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\as-in\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%TEMP%\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Macromedia\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\www.macromedia.com\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Media Center Programs\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Microsoft\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\az-latn-az\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Network Shortcuts\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Printer Shortcuts\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\SendTo\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\be\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%USERPROFILE%\\Desktop\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%USERPROFILE%\\Documents\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%USERPROFILE%\\Downloads\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%USERPROFILE%\\Favorites\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%USERPROFILE%\\Links\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-bd\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%USERPROFILE%\\Pictures\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-in\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%USERPROFILE%\\Saved Games\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%USERPROFILE%\\Videos\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\ca-es-valencia\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%USERPROFILE%\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%USERPROFILE%\\AppData\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Adobe\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AIR\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AIR\\logs\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Color\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Color\\Profiles\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\CEF\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\CEF\\User Data\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\ElevatedDiagnostics\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\MSfree Inc\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Credentials\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\FORMS\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\Feeds for United States~\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\Microsoft Feeds~\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds Cache\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\gd-latn\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\kk\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\km-kh\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\InputPersonalization\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\InputPersonalization\\TrainedDataStore\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\CloudStore\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Shell\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\WinX\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\WinX\\Group1\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\WinX\\Group2\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\WinX\\Group3\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Sidebar\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Sidebar\\Gadgets\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\WindowsApps\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft Help\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Network\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Network\\Connections\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Network\\Connections\\Cm\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Network\\Connections\\_hiddencm\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\CloudStore\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%USERPROFILE%\\3D Objects\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Comms\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Comms\\Unistore\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Comms\\Unistore\\data\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Comms\\UnistoreDB\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\ConnectedDevicesPlatform\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\DBG\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\ElevatedDiagnostics\\460911090\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\ElevatedDiagnostics\\460911090\\2022042817.000\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Ad Blocking\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\AutoLaunchProtocolsComponent\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\AutoLaunchProtocolsComponent\\1.0.0.8\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Autofill\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Autofill\\3.0.0.3\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\BrowserMetrics\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\CertificateRevocation\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\CertificateRevocation\\6498.2022.5.1\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\attachments\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\reports\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\AssistanceHome\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\AutofillStrikeDatabase\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\BudgetDatabase\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\RECOVERY_DARKBIT.txt","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\REGFILESHASH\\REGFILESHASH","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\REGFILES0000\\REGFILES0000","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\dbdbdbdb","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"Global\\dbdbdbdb","sources":[{"report_type":"sandbox","report_id":"63ec16907a108208ba0525e5"},{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7412:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"Local\\SM0:7412:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]},{"name":"Local\\SM0:7412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63e946d8f169391d2b119bea"}]}]}},"report_ids":{"sandbox_job_ids":["63ec16907a108208ba0525e5","63e946d8f169391d2b119bea"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Ransom.DarkBit Sample 9107be160f7b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9107be160f7b…. Malware family: Trojan.Ransom.DarkBit. Threat score 100/100. 20/25 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.DarkBit Sample 9107be160f7b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9107be160f7b…. Malware family: Trojan.Ransom.DarkBit. Threat score 100/100. 20/25 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.DarkBit Sample 9107be160f7b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9107be160f7b…. Malware family: Trojan.Ransom.DarkBit. Threat score 100/100. 20/25 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]