GLOBE

24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 91426084700d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 91426084700d…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7"],"about":{"@type":"SoftwareApplication","name":"91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7","applicationCategory":["peexe","executable"],"identifier":"91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T172f,"

" (Source: 00018176-00001592-0000018C-46066481, Indicator: "files are encrypted") "l your files have been encrypted due to a security problem with your PC.

To restore all your fi" (Source: 00018176-00001592-0000018C-46067561, Indicator: "files have been encrypted") "eive instructions to decrypt your files!

In a response letter you will rece" (Source: 00018176-00001592-0000018C-46068328, Indicator: "decrypt your files") " GLOBE

Your personal ID

2617673882103423715514761618809062422339653804086992723122517704287495680791109641506104688976658460
6489568058980283303433956021267189187998210152531044273804063709788226765583294189866584193840729983
9301594758644606943559363539622774816347797764653976379412764297209768030952190003088277039861065638
3644875845226992163244170549554585515656108712018516974603112836992334400812846835350881104867031810
2857455460881775478192696011703121042787267885759572847079372300466422734768200307551765068335949345
9706762321712454108149988316470674038920462685766002310660548682652050956778994585120141120171112763
800690919841132698

... !!! !!! -->

All your files have been encrypted due to a security problem with your PC.

To restore all your files, you need a decryption.

If you want to restore them, write us to the e-mail jeepdayz@india.com.

In a letter to send Your personal ID (see In the beginning of this document).

You have to pay for decryption in Bitcoins.

The price depends on how fast you write to us.

After payment we will send you the decryption tool that will decrypt all your files.

In the letter, you will receive instructions to decrypt your files!

In a response letter you will receive the address of Bitcoin-wallet, which is necessary to perform the transfer of funds.

HURRY! Your personal code for decryption stored with us only 72 HOURS!

Our tech support is available 24 \ 7

Do not delete: Your personal ID
Write on e-mail, we will help you!

Free decryption as guarantee

Before paying you can send to us up to 3 files for free decryption.

Please note that files must NOT contain valuable information and their total size must be less than 10Mb.

When the transfer is confirmed, you will receive interpreter files to your computer.

After start-interpreter program, all your files will be restored.

Attention!

Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Do not attempt to remove the program or run the anti-virus tools
Attempts to self-decrypting files will result in the loss of your data
Decoders are not compatible with other users of your data, because each user's unique encryption key

" (Source: How To Recover Encrypted Files.hta, Indicator: "decrypt your files") "" (Source: How To Recover Encrypted Files.hta, Indicator: "files are encrypted") "

All your files have been encrypted due to a security problem with your PC." (Source: How To Recover Encrypted Files.hta, Indicator: "files have been encrypted") "

In the letter, you will receive instructions to decrypt your files!

" (Source: How To Recover Encrypted Files.hta, Indicator: "decrypt your files")26:T729,"amd.exe" opened "%APPDATA%\amd.exe" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Contacts\desktop.ini" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Contacts\PSPUBWS.contact" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Desktop background.png" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Documents\desktop.ini" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Downloads\desktop.ini" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\desktop.ini" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\Links\desktop.ini" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\Links\Suggested Sites.url" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\Links\Web Slice Gallery.url" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\Links for United States\desktop.ini" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\Links for United States\GobiernoUSA.gov.url" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\Microsoft Websites\IE Add-on site.url" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\Microsoft Websites\IE site on Microsoft.com.url" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\Microsoft Websites\Microsoft At Home.url" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\Microsoft Websites\Microsoft At Work.url" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\Microsoft Websites\Microsoft Store.url" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\MSN Websites\MSN Entertainment.url" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\MSN Websites\MSN Money.url" with delete access "amd.exe" opened "C:\Users\BHPr6Lr\Favorites\MSN Websites\MSN Sports.url" with delete access27:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3d3dweIiIiIiIiIiIiIiIiIiIcHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh3d3d3d3d3d3d3d3d3eHB4iIiIiIiIiIiIiIiIiIhweEREREREREREREAAAAAAcHhERERERERERERIgIgIgHB4RERERERERERESICICIBweEREREREREREREREREREcHiIiIiIiIiIiIiIiIiIiHB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3d3dweIiIiIiIiIiIiIiIiIiIcHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh3d3d3d3d3d3d3d3d3eHB4iIiIiIiIiIiIiIiIiIhweEREREREREREREAAAAAAcHhERERERERERERIgIgIgHB4RERERERERERESICICIBweEREREREREREREREREREcHiIiIiIiIiIiIiIiIiIiHB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790830215438,"unified_at":"2026-10-01T04:50:15.438Z","metadata":{"hashes":{"sha256":"91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7","sha1":"fa3ddd3426d5c0cd9d10c38b357e6e460f38cd06","md5":"fc2929755fd97c948254ee3760fb9140","sha512":"2e78d69210a6de7cb8e574a04182067e058204b24b5eb5973a41063073599c407d9b019d9041b287fe797c61636e845abe8a6c0830c69db717581c9b5b5ddf0c","ssdeep":"6144:7Ule28ctNWII1gsnn+CIOYPwxHoaVPARU19Sxo2fjMF:ue+NWII1gsn3I54YR+4o2K","ssdeep_chunks":["6144:7Ule28c","6144:Ule28ct","6144:le28ctN","6144:e28ctNW","6144:28ctNWI","6144:8ctNWII","6144:ctNWII1","6144:tNWII1g","6144:NWII1gs","6144:WII1gsn","6144:II1gsnn","6144:I1gsnn+","6144:1gsnn+C","6144:gsnn+CI","6144:snn+CIO","6144:nn+CIOY","6144:n+CIOYP","6144:+CIOYPw","6144:CIOYPwx","6144:IOYPwxH","6144:OYPwxHo","6144:YPwxHoa","6144:PwxHoaV","6144:wxHoaVP","6144:xHoaVPA","6144:HoaVPAR","6144:oaVPARU","6144:aVPARU1","6144:VPARU19","6144:PARU19S","6144:ARU19Sx","6144:RU19Sxo","6144:U19Sxo2","6144:19Sxo2f","6144:9Sxo2fj","6144:Sxo2fjM","6144:xo2fjMF","12288:7Ule28c","12288:Ule28ct","12288:le28ctN","12288:e28ctNW","12288:28ctNWI","12288:8ctNWII","12288:ctNWII1","12288:tNWII1g","12288:NWII1gs","12288:WII1gsn","12288:II1gsnn","12288:I1gsnn+","12288:1gsnn+C","12288:gsnn+CI","12288:snn+CIO","12288:nn+CIOY","12288:n+CIOYP","12288:+CIOYPw","12288:CIOYPwx","12288:IOYPwxH","12288:OYPwxHo","12288:YPwxHoa","12288:PwxHoaV","12288:wxHoaVP","12288:xHoaVPA","12288:HoaVPAR","12288:oaVPARU","12288:aVPARU1","12288:VPARU19","12288:PARU19S","12288:ARU19Sx","12288:RU19Sxo","12288:U19Sxo2","12288:19Sxo2f","12288:9Sxo2fj","12288:Sxo2fjM","12288:xo2fjMF","6144:ue+NWII","6144:e+NWII1","6144:+NWII1g","6144:II1gsn3","6144:I1gsn3I","6144:1gsn3I5","6144:gsn3I54","6144:sn3I54Y","6144:n3I54YR","6144:3I54YR+","6144:I54YR+4","6144:54YR+4o","6144:4YR+4o2","6144:YR+4o2K"],"imphash":"8c445e0177d2b5e73647ca0c287ad2f7"},"file_info":{"file_name":"91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7","file_type":["peexe","executable"],"file_type_id":"exe","file_size":446976,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287846000,"last_seen":1664835233000,"last_multi_scan":1664835233000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["Globe","ransomware"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":15,"malicious_count":4,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Purga","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Dropper]/Win32.Dorifel","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1233054","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Amnesia.0ADBFE84","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Amnesia.0ADBFE84 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.FS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.FileCrypter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050d6e11 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Purga.ah","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXAX-RJ!FC2929755FD9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.eleeyw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Pulobe.A8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Mal_Purge","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Mal_Purge","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00017615-00002100-13189-736-00409384\n GetLocalTime@KERNEL32.DLL at 00018176-00001592-18948-737-00409384","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00017615-00002100-13189-1397-00405FE8\n GetVersionExA@KERNEL32.DLL at 00017615-00002100-13189-760-0040B800\n GetVersionExA@KERNEL32.DLL at 00018176-00001592-18948-761-0040B800\n GetVersion@KERNEL32.DLL at 00018176-00001592-18948-1398-00405FE8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00017615-00002100-13189-724-004081A0\n GetDiskFreeSpaceA@KERNEL32.DLL at 00018176-00001592-18948-725-004081A0","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL (Target: \"91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7.exe\"; Stream UID: \"00017615-00002100-13189-1397-00405FE8\")\n which is directly followed by \"cmp eax, 80000000h\" and \"je 00406091h\". See related instructions: \"...\n+97 call 004012FCh\n+102 mov dword ptr [00468038h], eax\n+107 call 004012E4h ;GetVersion\n+112 and eax, 80000000h\n+117 cmp eax, 80000000h\n+122 je 00406091h\" ... at 00017615-00002100-13189-1397-00405FE8\n Found API call GetVersion@KERNEL32.DLL (Target: \"amd.exe\"; Stream UID: \"00018176-00001592-18948-1398-00405FE8\")\n which is directly followed by \"cmp eax, 80000000h\" and \"je 00406091h\". See related instructions: \"...\n+97 call 004012FCh\n+102 mov dword ptr [00468038h], eax\n+107 call 004012E4h ;GetVersion\n+112 and eax, 80000000h\n+117 cmp eax, 80000000h\n+122 je 00406091h\" ... at 00018176-00001592-18948-1398-00405FE8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\{a3af5c44-b74e-41d5-a87a-4a043a1fb0ec}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"amd.exe\" (UID: 00018176-00001592)\n Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('WScript.Shell');setInterval(function(){try{o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\Scanner','C:\\\\Users\\\\BHPr6Lr\\\\AppData\\\\Roaming\\\\amd.exe');}catch(e){}}\n10);\"\" (UID: 00018600-00002400)\n Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('C:\\\\Users\\\\BHPr6Lr\\\\AppData\\\\Roaming\\\\amd.exe');close()}catch(e){}}\n10);\"\" (UID: 00026196-00003180)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"How To Recover Encrypted Files.hta\" has type \"HTML document ISO-8859 text with CRLF line terminators\"\n \"uyiM55dBvSAooQbFlCrxlM.jeepdayz@india.com\" has type \"data\"\n \"QtFG+UvxK6m44mJOU7--qeeQomworo0oiuiJugExw44.jeepdayz@india.com\" has type \"data\"\n \"DNLQFPXx6gaBBiI--SDvvCYyGSXi3cahcPeD-r4IHhw.jeepdayz@india.com\" has type \"data\"\n \"ipCV6hinZegFmJp7TGcYodSOkLrgYjMgxkeUSYMfymY.jeepdayz@india.com\" has type \"data\"\n \"ZEJeTFHVWXR0tkIrMx2N9nf25HLmOcKvuW69jw7aQNY.jeepdayz@india.com\" has type \"data\"\n \"sSyCYh8sKEK5TFM0j0n21XbdNPao8pI8+DLMnykThAs.jeepdayz@india.com\" has type \"data\"\n \"8xJYJtJO068dyeQfVqOgug.jeepdayz@india.com\" has type \"data\"\n \"YHjc-4esuAu-UDskLpxn0odwIz3ZONBknr+rBVJV0Cc.jeepdayz@india.com\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db\"\n \"amd.exe\" touched file \"%WINDIR%\\system32\\mshta.exe\"\n \"amd.exe\" touched file \"%WINDIR%\\system32\\en-US\\mshta.exe.mui\"\n \"amd.exe\" touched file \"%WINDIR%\\system32\\en\\mshta.exe.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7.exe.bin\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vboxservice.exe\" (Indicator: \"vbox\")\n \"vboxservice.exe\" (Indicator: \"vboxservice\")\n \"vmtoolsd.exe\" (Indicator: \"vmtools\")\n \"vbox\" (Indicator: \"vbox\")\n \"qemu\" (Indicator: \"qemu\")\n \"vmware\" (Indicator: \"vmware\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"amd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"amd.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"amd.exe\" called \"OpenService\" to access the \"LanmanWorkstation\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"amd.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"amd.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"HOW TO RECOVER ENCRYPTED FILES\"; Value: \"mshta.exe \"%USERPROFILE%\\How To Recover Encrypted Files.hta\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"ping 127.0.0.1 -n 3 && shutdown -s -f -t\"\n Heuristic match: \"ping 127.0.0.1 -n 3 && shutdown -f\"\n Heuristic match: \"ping 127.0.0.1 -n 3 && shutdown /p /f\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$25","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n GetFileAttributesA\n WriteFile\n CopyFileA\n GetModuleFileNameA\n LoadLibraryExA\n UnhandledExceptionFilter\n GetModuleHandleA\n TerminateProcess\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n OpenProcess\n DeleteFileA\n GetProcAddress\n FindFirstFileA\n FindNextFileA\n CreateFileA\n WinExec\n GetCommandLineA\n CreateProcessA\n Sleep\n VirtualAlloc\n ShellExecuteExA\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"mshta.exe\" wrote bytes \"94988a7551c18a75efb29075ee9c8a7575dc8c7590978a7510998a7500000000013dfc7538edfc75cfcdfb753123fb75de2ffc75c4cafb7580bbfb7552bafb759fbbfb75707ffa7592bbfb7546bafb750abffb7500000000\" to virtual address \"0x6FBF1000\" (part of module \"MSLS31.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\amd.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"37/58 Antivirus vendors marked sample as malicious (63% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"37/58 Antivirus vendors marked sample as malicious (63% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":58,"dropped_files_count":0,"extracted_files_count":42,"files_written_count":31,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":6,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["Globe","ransomware"],"sample_flags":["Multi-Process","Extracted Files","User Comment"],"sandbox_reports":[{"id":"58b3b10caac2ed0e256c9bfe","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropped:Generic.Ransom.Purge","submit_name":"91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7","analysis_start_time":"2017-02-27T05:55:07+00:00","indicators_count":{"informative":11,"suspicious":20,"malicious":5},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}],"processes":[{"pid":2100,"ppid":0,"name":"91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7.exe","command_line":"","normalized_path":"C:\\91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7.exe","uid":"00017615-00002100","icon":"$27"},{"pid":1592,"ppid":2100,"name":"amd.exe","command_line":"","normalized_path":"%APPDATA%\\amd.exe","parent_uid":"00017615-00002100","uid":"00018176-00001592"},{"pid":2400,"ppid":1592,"name":"mshta.exe","command_line":"\"javascript:o=new ActiveXObject('WScript.Shell');setInterval(function(){try{o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\Scanner','C:\\\\Users\\\\BHPr6Lr\\\\AppData\\\\Roaming\\\\amd.exe');}catch(e){}},10);\"","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00018176-00001592","uid":"00018600-00002400","icon":"$28"},{"pid":3180,"ppid":1592,"name":"mshta.exe","command_line":"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('C:\\\\Users\\\\BHPr6Lr\\\\AppData\\\\Roaming\\\\amd.exe');close()}catch(e){}},10);\"","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00018176-00001592","uid":"00026196-00003180","icon":"$29"}],"all_imported_dlls":["advapi32.dll","netutils.dll","oleaccrc.dll","user32.dll","usp10.dll","setupapi.dll","browcli.dll","lpk.dll","ole32.dll","propsys.dll","devobj.dll","psapi.dll","oleaut32.dll","msctf.dll","ntmarta.dll","dwmapi.dll","ieframe.dll","shlwapi.dll","cscapi.dll","cryptsp.dll","kernel32.dll","imm32.dll","cfgmgr32.dll","davhlpr.dll","msls31.dll","version.dll","mpr.dll","KernelBase.dll","comctl32.dll","oleacc.dll","rpcss.dll","Wldap32.dll","apphelp.dll","winsta.dll","crypt32.dll","wkscli.dll","netmsg.dll","srvcli.dll","mshtml.dll","msvcrt.dll","clbcatq.dll","msasn1.dll","ntlanman.dll","jscript.dll","urlmon.dll","uxtheme.dll","wininet.dll","sspicli.dll","ntdll.dll","cryptbase.dll","iertutil.dll","gdi32.dll","sechost.dll","rpcrt4.dll","profapi.dll","davclnt.dll","shell32.dll","drprov.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"How To Recover Encrypted Files.hta","sha256":"51bba46451b3e0444a6caef912bdea4fac9003dffc96b2daaf29f9b470c5ea5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"lmBjRRM0vhp6+3arMKBSWM.jeepdayz@india.com","sha256":"ccfcd18b2a44c0fe2501a6d5f791819ffbbb9a35eb0a09ed5f444dcbef95708a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"P4QpM9YPOHsuHOYNTPUdzM.jeepdayz@india.com","sha256":"d584197c6a1412cf7bbc6517a82536bcd848531f5fc401acb837943f7610a079","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"YHjc-4esuAu-UDskLpxn0odwIz3ZONBknr+rBVJV0Cc.jeepdayz@india.com","sha256":"688ef3ef8a6021361966e91cd0b6f24143a0fea2e598c8c04bcaf57e3bd455e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"CSaE-DkpA1JeMVALCJOTJUdwIz3ZONBknr+rBVJV0Cc.jeepdayz@india.com","sha256":"195a4075e4134f94c25ca9d22d7e5ace69636643a53b0711da99d22495f1ca29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"fvaGzODEC-NZXNW8ode0A3ryRldqD4Nl40PGOQs9zhI.jeepdayz@india.com","sha256":"d34b042488c2629278e32c41ceae241648ebfd5e65b2fafb96570ab15d03adae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"MWag-K4azmMAhaXbYbXnww.jeepdayz@india.com","sha256":"2e9d639d0d2c8903d5150e88fe15a8ca59f65e806479cb178a86452f1b486ba4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"RBlzgfp8W3bTZ4gvAPmWtg.jeepdayz@india.com","sha256":"331a7088493d1c57769efecc0ac6503926d9c3680d89bf08528a58a3463f0a90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"ic9uVFPBlJBhP79RpGN1Wqihul+Ft-RoNP6s0EWghMM.jeepdayz@india.com","sha256":"d3c490a7b662ff8b774d3cde7a46dc14ef77023b2079d1d0af3ffeff3af96d70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"lZLephqOeSSof7PyyDa87w.jeepdayz@india.com","sha256":"c5e2251b144c3c3d00707765a3caa44245002705888ee0f67b317cb3aa56df52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"rZPUu-4tto8rH3FnQBLVT0.jeepdayz@india.com","sha256":"e2cfdaa2774c2487db381a6411031915a2bbc8de30d9f5c7af5d61638e90e388","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"yrk7FtSJzMeneXyd6PO930.jeepdayz@india.com","sha256":"860f7ff689971d2f8d0ca892910f6a391443bcce44c9f5c363cd370347dd6c6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"Cl+Ve6NLO4l7ZDzphccJiwTlwVO9IhkVAxHoowHg4ws.jeepdayz@india.com","sha256":"67b6759f94b94cf8235230d93de0625b120571b3a2ba1a8ceebd44f0bc1bcf8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"MK8mVrJoGEDUSOrwrElkDnos9F47k-IClUI+E6e3CFo.jeepdayz@india.com","sha256":"9925a85229540172ec55a4a8a07b00b832692595c2f7879bac9b2d587c868553","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"X6843f8TDAVCCPxRnUJ25DTqZ9wzNkW47hcBM3RGMSw.jeepdayz@india.com","sha256":"4ac49cc6db41bbd0bb45d0deb38ffd4f49b6676a81851dd1368154c00ab8d060","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"XKMmwb+ElrpdhUq3tPpKi5t2HXVy9Wxyt8PSYdRHPLo.jeepdayz@india.com","sha256":"90896d179c16cf693a6536d45f54822a29e5067042f71fb45df76c677139f912","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"z0ZP1fqkHSguxiE-uFzHHodwIz3ZONBknr+rBVJV0Cc.jeepdayz@india.com","sha256":"a14d032fbf3bee7efdaef0d5326e6dc6fbc06b8184f1dc2d73ae906d168bfc36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"3fdKQYvrEuB7MOlE90Z37LA8NObBcFM96vt-rGyolYs.jeepdayz@india.com","sha256":"146dee2bf843fe5e67e75424b38b03c884392a54bd32488fb0922f807385f4b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"DNLQFPXx6gaBBiI--SDvvCYyGSXi3cahcPeD-r4IHhw.jeepdayz@india.com","sha256":"022a05f708bc3c6d50b0b2a7c7956777efc3d6a68acb206f0c2c95762c625d4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"ZEJeTFHVWXR0tkIrMx2N9nf25HLmOcKvuW69jw7aQNY.jeepdayz@india.com","sha256":"dcc6766d964bd2aad70f315c0f840513c34232e57ce83ee7de0200ef76ccdf0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"ipCV6hinZegFmJp7TGcYodSOkLrgYjMgxkeUSYMfymY.jeepdayz@india.com","sha256":"133729bedd7507564689d20e2ecf5bd0a179da46807436bfa77ecf2d572c095f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"MauaalT8P+CiaT2jRFuBpM.jeepdayz@india.com","sha256":"113d13e05753e8e26b68a64cb2a9f3555f69e9a1f15fdbcb1f64b898e4baa616","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"QtFG+UvxK6m44mJOU7--qeeQomworo0oiuiJugExw44.jeepdayz@india.com","sha256":"f1e727cd742e1564a06462dfd82a43341eb1e025d97f9393a4faf4e9a340d28c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"-2k0yDhkzMX0A7F5CkinZVnKtXOgKKWoEZlNFSDApT8.jeepdayz@india.com","sha256":"e05f9fde3f6eb1e96e80a678b390b71f8c75c4f1e3ecc567fa92ee0a3529820e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"DdrOWtWHXA+UZvNlOdkQ7DJ5Ovw3tUPZrj7F3eKhYio.jeepdayz@india.com","sha256":"c76663a2e1b16fe70b80c83b7a8981cbaf6977722835c135f491af1be47901b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"uyiM55dBvSAooQbFlCrxlM.jeepdayz@india.com","sha256":"2d38f1917c170bc61ec7291aecfebc90f11249a571154961d6384dcce1d5be1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"iQ5j-jhKhOYYdM2tf0kn-g.jeepdayz@india.com","sha256":"df115719069f3d9eb36457b5044db33ceb3fc6080d203585503bb97b22ee60a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"-l-7t-no7W9WXxfWruymLm56mCXtt-2rLecpx+gHyfaTZf7D4LGKDyZ7Yf9tFHJav0YWkwJt5-YJxhzmiCoCuHliDgXzeTlRrk-CeTbY-Zk.jeepdayz@india.com","sha256":"91e27e316203449af080ae687618251ab4d5d2401234170818cf25597fcdb0db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"6LHJkRPGi+KUv8Jtj9uN0w.jeepdayz@india.com","sha256":"c33db5d8eb295f99aff5ea8b3acb7fe728ea22ccd2589aba0ace356e5c2ca0f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"AMDlQnuuk57IfmAODoYVH0.jeepdayz@india.com","sha256":"38778bd383c181f81efc8a9b674ffca82bffba342306f06c9671bd5deb427c18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"sSyCYh8sKEK5TFM0j0n21XbdNPao8pI8+DLMnykThAs.jeepdayz@india.com","sha256":"70f6fd61a6d8a456d61e98160a6fc0787c2b4d76b428c2e8e521bf69b52c38a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"8xJYJtJO068dyeQfVqOgug.jeepdayz@india.com","sha256":"7a193837b551417b042d79453d706f15c21c225026ac3381a4aa92760e57155a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"IqPa3qkvqfrAITEf4+b3YM.jeepdayz@india.com","sha256":"ada4ae062386f77758a64ea502f13a533a7c4e71270116a1315a93c919ae3d3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"HpoCzfOAYpHoF7tuQDKApw.jeepdayz@india.com","sha256":"0966104008dc96a98d274a55288c255a3119cc6c601b493e25177b02b12c6ee9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"YouhmxGh0rjcYmkgMSLx6M.jeepdayz@india.com","sha256":"86c777d9d5f02eb03cfa10d4a253aa03c1eb806d77b7ebdd7bed6264b0941eb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"3-iwkmWm89BEkEbvbzgS7M.jeepdayz@india.com","sha256":"a5c92fd81b782108ab015c12f68aec78800468a450b60db8770f8ad6f9ea2531","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"GIPXmN-bAGaUlAKyxk5bjw.jeepdayz@india.com","sha256":"3120d3d0ba8a6f42fc42ed7626fa00ac833b92d51b4015211840f3200d07d342","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"-Wn+QwDJeKbJP0VQa4SOK0.jeepdayz@india.com","sha256":"364504311882344d1e011597d7df9551c4271dd02ee6d44397c2dada5ddfbcf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"JM2BB+LYQsoFx10pJyZtfw.jeepdayz@india.com","sha256":"5c722797ce5ed05e482973c4f295d08d4127a19b10083db8795d05416da88ff4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"kLhWY7+dUSUxqp9gNhvC9w.jeepdayz@india.com","sha256":"a90bc4b4581204928900e2975dc609290ecd36084795942a6bc89dff89bbcc96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"Xp5jLdT17HyrVBDzaRq8JXfVHumOTV85eAJK880fv4w.jeepdayz@india.com","sha256":"6c567901ddceb68d215fabe3377a04e760883c8bf9a1850ee3bac38b977cfb9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"hQiM0U1-9bxxcq6ptAqT0M.jeepdayz@india.com","sha256":"fed85bad951006c965c4f4163d9e0ec6e6e72a95732b03c93ed4c17615c45ccf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]}],"files_written":[{"path":"C:\\91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%APPDATA%\\amd.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%WINDIR%\\system32\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%WINDIR%\\system32\\en\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Contacts\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Documents\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Downloads\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Favorites\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Links\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Music\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Pictures\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Saved Games\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Searches\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%USERPROFILE%\\Videos\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"C:\\How To Recover Encrypted Files.hta","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%WINDIR%\\system32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\{A3AF5C44-B74E-41D5-A87A-4A043A1FB0EC}\\","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\{A3AF5C44-B74E-41D5-A87A-4A043A1FB0EC}\\TEMP\\TEMP","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\SCANNER\\SCANNER","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{a3af5c44-b74e-41d5-a87a-4a043a1fb0ec}","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"58b3b10caac2ed0e256c9bfe"}]}]}},"report_ids":{"sandbox_job_ids":["58b3b10caac2ed0e256c9bfe"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 91426084700d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 91426084700d…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 91426084700d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 91426084700d…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/91426084700d15e139c75ee9f3d100bd79d359cf5775de4603279f36b6bf6fc7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 91426084700d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 91426084700d…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]