26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4ae,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 9a522b3b5a51… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9a522b3b5a51…. Malware family: Trojan.Generic. Threat score 100/100. 18/26 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9a522b3b5a51b5e021977ad55780f527d58193d587b1c01588e07cc40a69f884","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","9a522b3b5a51b5e021977ad55780f527d58193d587b1c01588e07cc40a69f884"],"about":{"@type":"SoftwareApplication","name":"HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe","applicationCategory":["peexe","executable"],"identifier":"9a522b3b5a51b5e021977ad55780f527d58193d587b1c01588e07cc40a69f884","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T990,"" opened "c:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access28:T9f7,Found string "NetStatisticsGet" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: NETAPI32.DLL) Found string "NetApiBufferFree" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: NETUTILS.DLL) Found string "CryptAcquireContextW" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: CRYPTSP.DLL) Found string "CryptGenRandom" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: CRYPTSP.DLL) Found string "CryptReleaseContext" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: CRYPTSP.DLL) Found string "GetForegroundWindow" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: USER32.DLL) Found string "GetCursorInfo" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: USER32.DLL) Found string "GetQueueStatus" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: USER32.DLL) Found string "CreateToolhelp32Snapshot" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL) Found string "Heap32First" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL) Found string "Heap32Next" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL) Found string "Heap32ListFirst" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL) Found string "Heap32ListNext" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL) Found string "Process32First" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL) Found string "Process32Next" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL) Found string "Thread32First" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL) Found string "Thread32Next" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL) Found string "Module32First" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL) Found string "Module32Next" (Source: HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin, API is part of module: KERNEL32.DLL)29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9a522b3b5a51b5e021977ad55780f527d58193d587b1c01588e07cc40a69f884","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791115029185,"unified_at":"2026-10-04T11:57:09.185Z","metadata":{"hashes":{"sha256":"9a522b3b5a51b5e021977ad55780f527d58193d587b1c01588e07cc40a69f884","sha1":"e322ee27442d10c207124eefab9445e29aa77b98","md5":"4df8460a4496280ac122215aa39fce4d","sha512":"9601974274ab98d2d4cc7dd8c60beae7ad44b03fffb522bb1c5136e7c78ad4e68997b3492790ae7fa0b966d245a4c7088c8fb13bba387203de7eade46742f52f","ssdeep":"49152:5owp5gR7BF/hBPGzBY+kBaBeImuobQO+K+gbqZ1BzYm0Yk60gQcH0YiJK:5owp5gR9FfIBfKaBeImuobQO+K+g21BX","ssdeep_chunks":["49152:5owp5gR","49152:owp5gR7","49152:wp5gR7B","49152:p5gR7BF","49152:5gR7BF/","49152:gR7BF/h","49152:R7BF/hB","49152:7BF/hBP","49152:BF/hBPG","49152:F/hBPGz","49152:/hBPGzB","49152:hBPGzBY","49152:BPGzBY+","49152:PGzBY+k","49152:GzBY+kB","49152:zBY+kBa","49152:BY+kBaB","49152:Y+kBaBe","49152:+kBaBeI","49152:kBaBeIm","49152:BaBeImu","49152:aBeImuo","49152:BeImuob","49152:eImuobQ","49152:ImuobQO","49152:muobQO+","49152:uobQO+K","49152:obQO+K+","49152:bQO+K+g","49152:QO+K+gb","49152:O+K+gbq","49152:+K+gbqZ","49152:K+gbqZ1","49152:+gbqZ1B","49152:gbqZ1Bz","49152:bqZ1BzY","49152:qZ1BzYm","49152:Z1BzYm0","49152:1BzYm0Y","49152:BzYm0Yk","49152:zYm0Yk6","49152:Ym0Yk60","49152:m0Yk60g","49152:0Yk60gQ","49152:Yk60gQc","49152:k60gQcH","49152:60gQcH0","49152:0gQcH0Y","49152:gQcH0Yi","49152:QcH0YiJ","49152:cH0YiJK","98304:5owp5gR","98304:owp5gR7","98304:wp5gR7B","98304:p5gR7BF","98304:5gR7BF/","98304:gR7BF/h","98304:R7BF/hB","98304:7BF/hBP","98304:BF/hBPG","98304:F/hBPGz","98304:/hBPGzB","98304:hBPGzBY","98304:BPGzBY+","98304:PGzBY+k","98304:GzBY+kB","98304:zBY+kBa","98304:BY+kBaB","98304:Y+kBaBe","98304:+kBaBeI","98304:kBaBeIm","98304:BaBeImu","98304:aBeImuo","98304:BeImuob","98304:eImuobQ","98304:ImuobQO","98304:muobQO+","98304:uobQO+K","98304:obQO+K+","98304:bQO+K+g","98304:QO+K+gb","98304:O+K+gbq","98304:+K+gbqZ","98304:K+gbqZ1","98304:+gbqZ1B","98304:gbqZ1Bz","98304:bqZ1BzY","98304:qZ1BzYm","98304:Z1BzYm0","98304:1BzYm0Y","98304:BzYm0Yk","98304:zYm0Yk6","98304:Ym0Yk60","98304:m0Yk60g","98304:0Yk60gQ","98304:Yk60gQc","98304:k60gQcH","98304:60gQcH0","98304:0gQcH0Y","98304:gQcH0Yi","98304:QcH0YiJ","98304:cH0YiJK","49152:owp5gR9","49152:wp5gR9F","49152:p5gR9Ff","49152:5gR9FfI","49152:gR9FfIB","49152:R9FfIBf","49152:9FfIBfK","49152:FfIBfKa","49152:fIBfKaB","49152:IBfKaBe","49152:BfKaBeI","49152:fKaBeIm","49152:KaBeImu","49152:QO+K+g2","49152:O+K+g21","49152:+K+g21B","49152:K+g21BX"],"imphash":"bf2e894eb3fcabe088b4192d639fdd41"},"file_info":{"file_name":"HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2639360,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1527351999000,"last_seen":1653378585000,"last_multi_scan":1653378585000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["Dont_Worry","ransomware","armalocky","bitcoinminer","coinminer","fynloski","gamehack","hiddentear","jaffrans","jrat","locky","milicry","miner","neshta","njrat","rat","suloc","taily","tiggre","vbinder"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":14,"malicious_count":4,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Ransom.keirp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.RTH.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Heur.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.RTH.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.Russenger.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/W64.LockFile.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Russenger","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00531d8d1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXHE-FU!4DF8460A4496","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.fceiru","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.WCryG.S2650646","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_NOWORI.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_NOWORI.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Crypmod","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 28077-52-004014E0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009155-00004000-23863-1-004014E0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00009155-00004000-23863-521-00517EE0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00009155-00004000-23863-303-00412180","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\3230959184248808531\"\n \"3230959184248808531\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Application Verifier.lnk\" has type \"data\"\n \"demo_script.ps1\" has type \"data\"\n \"omniprov.doc\" has type \"data\"\n \"content_classifier.ps1\" has type \"data\"\n \"contoso.cer\" has type \"PGP\\011Secret Sub-key -\"\n \"FreeCellMCE.lnk\" has type \"data\"\n \"_Excel4.xls\" has type \"data\"\n \"Dont_Worry.txt\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"\n \"Makefile\" has type \"data\"\n \"DGATNGET.XML\" has type \"data\"\n \"dev.htm\" has type \"Dyalog APL component file 64-bit non-journaled checksummed version 208.1\"\n \"BD14795_.GIF\" has type \"data\"\n \"getnetworkadapterconfig.pl\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.openssl.org/support/faq.html\"\n Pattern match: \"https://gcc.gnu.org/bugs/\"\n Pattern match: \"https://www.torproject.org/download/download-easy.html\"\n Pattern match: \"http://torbox3uiot6wchz.onion/signup-en.php\"\n Pattern match: \"http://torbox3uiot6wchz.onion/sm/\"\n Heuristic match: \"e-mail: e-mail: ups@torbox3uiot6wchz.onion\"\n Pattern match: \"http://torbox3uiot6wchz.onion/relay-en.php\"\n Heuristic match: \".*\\.md\"\n Heuristic match: \".*\\.cf\"\n Heuristic match: \".*\\.info\"\n Heuristic match: \".*\\.pf\"\n Heuristic match: \".*\\.bf\"\n Heuristic match: \".*\\.xxx\"\n Heuristic match: \".*\\.pm\"\n Heuristic match: \".*\\.pl\"\n Heuristic match: \".*\\.ai\"\n Heuristic match: \".*\\.gd\"\n Heuristic match: \".*\\.bz\"\n Heuristic match: \".*\\.nc\"\n Heuristic match: \".*\\.py\"\n Heuristic match: \".*\\.fi\"\n Heuristic match: \".*\\.dz\"\n Heuristic match: \".*\\.bg\"\n Heuristic match: \"e-mail: ups@torbox3uiot6wchz.onion\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00009155-00004000-00000105-4254688611","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00009155-00004000-00000105-4275237977","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00009155-00004000-23863-1828-005875B0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"https://www.torproject.org/download/download-easy.html\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00009155-00004000-23863-3-00404DC0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin\" has a TLS callback with entrypoint at 0x518070\n \"HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin\" has a TLS callback with entrypoint at 0x518020\n \"HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin\" has a TLS callback with entrypoint at 0x529e20","origin":"Static Parser","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetTickCount\n OutputDebugStringA\n LoadLibraryA\n GetFileSizeEx\n LockResource\n UnhandledExceptionFilter\n GetProcAddress\n GetThreadContext\n GetModuleHandleA\n FindNextFileW\n WriteFile\n GetStartupInfoA\n FindFirstFileW\n TerminateProcess\n GetModuleHandleW\n FindResourceW\n CreateFileW\n VirtualProtect\n Sleep\n ShellExecuteW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$28","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin\" has a section named \".eh_fram\"\n \"HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe.bin\" has a section named \".CRT\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"34/65 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"34/65 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"IBurn.csproj.FileList.txt\" which has been seen in the context of ransomware (Indicator: filelist.txt)\n Found dropped filename \"_ReadMe_.txt\" which has been seen in the context of ransomware (Indicator: README_.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"\" touched \"y:\\\"\n \"\" touched \"x:\\\"\n \"\" touched \"w:\\\"\n \"\" touched \"v:\\\"\n \"\" touched \"u:\\\"\n \"\" touched \"t:\\\"\n \"\" touched \"s:\\\"\n \"\" touched \"r:\\\"\n \"\" touched \"q:\\\"\n \"\" touched \"p:\\\"\n \"\" touched \"o:\\\"\n \"\" touched \"n:\\\"\n \"\" touched \"m:\\\"\n \"\" touched \"l:\\\"\n \"\" touched \"k:\\\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a known ransomware file"}],"sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":22,"dropped_files_count":0,"extracted_files_count":42,"files_written_count":135,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["Dont_Worry","ransomware","armalocky","bitcoinminer","coinminer","fynloski","gamehack","hiddentear","jaffrans","jrat","locky","milicry","miner","neshta","njrat","rat","suloc","taily","tiggre","vbinder"],"sample_flags":["Extracted Files","User Comment"],"sandbox_reports":[{"id":"5b098abd7ca3e101ef3415f8","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.WCryG","submit_name":"HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe","analysis_start_time":"2018-05-26T17:24:37+00:00","indicators_count":{"informative":9,"suspicious":15,"malicious":5},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}],"processes":[{"pid":4000,"ppid":0,"name":"HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe","command_line":"","sha256":"9a522b3b5a51b5e021977ad55780f527d58193d587b1c01588e07cc40a69f884","normalized_path":"C:\\HonestSample_Dont_Worry5b07c80a4b24264120bc64fe.exe","uid":"00009155-00004000","icon":"$29"}],"all_imported_dlls":["lpk.dll","netapi32.dll","netutils.dll","wkscli.dll","kernel32.dll","KernelBase.dll","rpcrt4.dll","usp10.dll","shlwapi.dll","imm32.dll","rsaenh.dll","ntdll.dll","gdi32.dll","shell32.dll","cryptbase.dll","sechost.dll","user32.dll","msctf.dll","srvcli.dll","cryptsp.dll","advapi32.dll","msvcrt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Liesmich.htm","sha256":"e33575f1aa9369fb66de41158a69c0b0ede9ab04ea8c55baeb64d48fe3f120f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"cef.pak","sha256":"b71a129289d060912404024073755921f0be1fafdbe5a0869db68efe18dd834b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"AdobeID.pdf","sha256":"e756d2169825e4bc439af1b96fe661bd1f2ae0f00bc8b0de7b15cd8c0af745ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"DefaultID.pdf","sha256":"1f1788e2d48aef44a543727b90116169c481f898af218adabf8a97e2a1d15d2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"license.html","sha256":"08c5b30b0976fba429a0cc7d86e6a65bf7742e834bfe945b2b462fd949a32b92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"create_form.gif","sha256":"8664c3408a700a68cdc3378cdfd66970b93c4976a1c7d56ebe36c35dce6f5e60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"distribute_form.gif","sha256":"589f1bc608d281ed6dabbb6eea15f8201f414707ad2ce33f64eb36d5c562bbf3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"email_initiator.gif","sha256":"03232695211f5f6ff98808fffc500c656ec99ac2a30b26dbbeed2f179835cbfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"ended_review_or_form.gif","sha256":"4aef4a8762b909357a985489859e3fabdc8d7eb7d33ae4653bbcbf15f2ce5010","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"forms_super.gif","sha256":"59964d2b4c5d9aeacbccc39c5078532aecd53e2b1f89264153dfc0cb490d30b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"info.gif","sha256":"9decbc3fbd3ab9dcc06e8b8cbd1b55cf65c02c7fdb2d844ee7c1b0a8c4ae733e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"MyriadCAD.otf","sha256":"af210ac6ebeb0d8059336b0909506a88a15fa673975926a94264b58f0016b343","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"Dynamic.pdf","sha256":"cbbc51d1128553782bb32b9765754c0d12536d2aea813c1c1985ff1f8d2e04fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"MinionPro-Bold.otf","sha256":"ca559b1a5ecfd60641ba57dd19a44c5612b95979c05850aa54220aa1697a33c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"MinionPro-It.otf","sha256":"8b970632fd7952103239dfa828fd2ea748e4e05c42f10655c81baad143db6f56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"CENTEURO.TXT","sha256":"bd682106e04ea27dacdfa18cf4877af9c3f096dd5e58191a9b9ef89d4703cb15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"GREEK.TXT","sha256":"9306627cb545fb72629a405dcfe2276d8a90b675481c1dee61f9a3fa8c8b5469","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"CP1251.TXT","sha256":"726d60d7795183c9ff4a5aa306a9b4a84da4a29e55839745305a28ab958a9c8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"CP1254.TXT","sha256":"1a455541d3e4e7258b97f19167c4f4c09cdae36d3e55566dc2c879fb71a72e1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"CP1258.TXT","sha256":"260444ae751d9113373a41dab9cefe3ea8b3f25ed06ae654af8397f94d481410","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"Application Verifier.lnk","sha256":"4377573c0878c09d08027ad4ade951c32237bf51a4109b7c4dbadcad448e4967","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"_Excel4.xls","sha256":"4584379fd2b168e19e8a22353c92270f5b74e0794095ec969bad1992f533b71c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"demo_script.ps1","sha256":"d6f83c36adcf5a33768a2dcb4ba4b8187d72ca2cbcc0d47f05d3d9bb971e3fe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"omniprov.doc","sha256":"7d98aaba4426c3f31f09cfcd6ec6e556731d3b98d7bf8d24a639867c0659d94b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"content_classifier.ps1","sha256":"f54031316f3b0f71820bc37364f8f65d9343233b40ca06c1a56507ab863b7bbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"contoso.cer","sha256":"27413b7e00b10e2b373dcf681b35a81806980488209b5a9d3d8a6f9009785ff6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"FreeCellMCE.lnk","sha256":"60865cbe99aecbdc0c66e4eee2cf6005a7e4a4cc10657c2df30b9b0ded90e006","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"getnetworkadapterconfig.pl","sha256":"deac11ae96bba978cbf2b381b1635fb4c432d3ebc81063d8f8312193b35cd830","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"getappboost.pl","sha256":"080cc70818a0530f097e8450e511a77ec9f49f08eb6adc8e32eae1321526558e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"domainname.pl","sha256":"df707e33f662c07a69c8d95642ef57df3e68e52d46148397f17cd745f84060be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"binding.pl","sha256":"04ad3194af4562c5ecc695ff2c9ae40603d57d81ea5f87b02d813c6d4f9b3e99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"osinfo.pl","sha256":"162ffef5f8b38b17eb2d56c254a329f7b94b8bd7153717e9baf9c08e8e26ead1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"listnetworkprotocols.pl","sha256":"c36af037a019fbd537f726d02369f8bbd453b68d7820e0738152aa5db6044770","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"pathbuild.pl","sha256":"2ab3a83978fb7360e5f2c9b90371a9f7d6c3a714a033cc0eb6ccc112e144078e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"deleteservice.pl","sha256":"dd7a840b78cc7e25fd1fe5ea0cabeadc56d16c2ad473d794dac2b957f4e029d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"listservices.pl","sha256":"5ce53833792970fa212803d1a593ae977f915b6e4ce8a56653c80cd5c6ee6f88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"nvsarray.pl","sha256":"a12020e765b1de10f21e96a15bcd269216e3b54b2e2207a63f8bf333513032ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"cleareventlog.pl","sha256":"fe89506cd604b9ca6fb04fce834b25b38475f6bed688ac7002009cf56d880a90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"objset.pl","sha256":"89c77184032d10b05b41623760bf63f842a60a3d137adb235a01e1214bb77ef5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"enabledhcp.pl","sha256":"35f6d5c5c6675f9065e9590cc168f06bcd0c22d4f4557ccc11a7bfcdea80753d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"machinename.pl","sha256":"9ae4e916a96692859628a3168011dabeda05a237de5f4adadd721ea4859c9050","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"cimomid.pl","sha256":"4126c406ecd42105d4a8ec36f36d5e098653bb81e540acb8dd117ca0760272bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]}],"files_written":[{"path":"\\192.168.56.1\\VM11\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"y:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"x:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"w:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"v:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"u:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"t:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"s:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"r:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"q:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"p:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"o:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"n:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"m:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"l:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"k:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"j:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"i:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"h:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"g:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"f:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"e:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"d:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\$Recycle.Bin\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\Users\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\PerfLogs\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"C:\\PerfLogs\\Admin\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Esl\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\prc\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\Identity-H","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\Identity-V","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\SaslPrep\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\ICU\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Setup Files\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Setup Files\\{AC76BA86-7AD7-1031-7B44-AB0000000001}\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\Application Verifier\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\AutoItX\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Images\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Simple\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Dont_Worry.txt","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\3230959184248808531","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]},{"name":"3230959184248808531","sources":[{"report_type":"sandbox","report_id":"5b098abd7ca3e101ef3415f8"}]}]}},"report_ids":{"sandbox_job_ids":["5b098abd7ca3e101ef3415f8"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 9a522b3b5a51… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9a522b3b5a51…. Malware family: Trojan.Generic. Threat score 100/100. 18/26 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9a522b3b5a51b5e021977ad55780f527d58193d587b1c01588e07cc40a69f884"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 9a522b3b5a51… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9a522b3b5a51…. Malware family: Trojan.Generic. Threat score 100/100. 18/26 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9a522b3b5a51b5e021977ad55780f527d58193d587b1c01588e07cc40a69f884"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 9a522b3b5a51… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9a522b3b5a51…. Malware family: Trojan.Generic. Threat score 100/100. 18/26 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]