23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.VBS Sample 9f476dccaa8e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9f476dccaa8e…. Malware family: Trojan.VBS. Threat score 100/100. 18/27 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9f476dccaa8ed2d8ee30cea0232413c236197ad7fff59b77d266b55dbcd711d6","keywords":["Malicious","Trojan.VBS","malware analysis","sandbox report","threat intelligence","9f476dccaa8ed2d8ee30cea0232413c236197ad7fff59b77d266b55dbcd711d6"],"about":{"@type":"SoftwareApplication","name":"20172.2017-07-31_75.20.68.vbs","applicationCategory":["script","vbs"],"identifier":"9f476dccaa8ed2d8ee30cea0232413c236197ad7fff59b77d266b55dbcd711d6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.VBS","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T533,"\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!qlf0fud!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!qlf0fud!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!qlf0fud!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!qlf0fud!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "Local\ZoneAttributeCacheCounterMutex" "Local\c:!users!qlf0fud!appdata!roaming!microsoft!windows!cookies!" "Local\c:!users!qlf0fud!appdata!local!microsoft!windows!history!history.ie5!" "IESQMMUTEX_0_208" "Local\ZonesLockedCacheCounterMutex" "Local\c:!users!qlf0fud!appdata!roaming!microsoft!windows!ietldcache!"25:T464,"wscript.exe" touched file "%WINDIR%\System32\en-US\WScript.exe.mui" "wscript.exe" touched file "%WINDIR%\System32\WScript.exe" "wscript.exe" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "wscript.exe" touched file "%WINDIR%\system32\rsaenh.dll" "wscript.exe" touched file "%WINDIR%\system32\en-US\KERNELBASE.dll.mui" "wscript.exe" touched file "%WINDIR%\System32\msxml3r.dll" "wscript.exe" touched file "%WINDIR%\system32\wshom.ocx" "wscript.exe" touched file "%WINDIR%\System32\msxml3.dll\1" "wscript.exe" touched file "%WINDIR%\System32\msxml3.dll" "wscript.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "wscript.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat" "wscript.exe" touched file "%APPDATA%\Microsoft\Windows\IETldCache\index.dat" "wscript.exe" touched file "C:\Users\QLF0fud\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\98wugf56[1].txt" "wscript.exe" touched file "C:\Users\QLF0fud\AppData\Local\Microsoft\Windows\Caches" "wscript.exe" touched file "C:\Users\QLF0fud\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"26:T61b,"RgorOPoL.exe" opened "C:\9f476dccaa8ed2d8ee30cea0232413c236197ad7fff59b77d266b55dbcd711d6.vbs" with delete access "RgorOPoL.exe" opened "C:\autoexec.bat" with delete access "RgorOPoL.exe" opened "C:\config.sys" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Users\QLF0fud\Desktop background.png" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\ntuser.ini" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Videos\desktop.ini" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Searches\desktop.ini" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Searches\Everywhere.search-ms" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Searches\Indexed Locations.search-ms" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Saved Games\desktop.ini" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Saved Games\Microsoft Games\desktop.ini" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Pictures\desktop.ini" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Music\desktop.ini" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Links\desktop.ini" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Links\Desktop.lnk" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Links\Downloads.lnk" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Links\RecentPlaces.lnk" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Favorites\desktop.ini" with delete access "RgorOPoL.exe" opened "%USERPROFILE%\Favorites\Windows Live\Get Windows Live.url" with delete access27:T759,Found malicious artifacts related to "81.169.145.77" (ASN: , Owner: ): ... URL: http://www.schottlandderhirschewegen.de/ (AV positives: 1/65 scanned on 07/31/2017 11:32:51) URL: http://www.zaunmontage-streich.de/beispiele.htm (AV positives: 2/65 scanned on 07/31/2017 10:57:51) URL: http://www.my-home.info/hausDesJahres/index-D.php (AV positives: 1/65 scanned on 07/31/2017 10:55:11) URL: http://urlaub.jungbluth.de/wp-content/uploads/2013/04/2013-04-04_10-11-17.jpg (AV positives: 1/65 scanned on 07/31/2017 10:48:42) URL: http://gemeinde-klink.info/geschichte/geschichtliches-ueber-klink/landesgeschichte/ (AV positives: 1/65 scanned on 07/31/2017 09:35:17) File SHA256: 73194fab6de23e7d6f46ea9f6bb9b34f02e271d5d21357701f2d409b75173382 (AV positives: 1/63 scanned on 07/28/2017 04:08:02) File SHA256: 7283ef729771babccafcac5cbdcc03dad2ffd4bcb05d0cb2ef72dc75f03e8d80 (AV positives: 7/63 scanned on 07/27/2017 14:38:53) File SHA256: b4896af1093d22c28cfd0241253a101c9f8053add272c9234f31afea1a90bc3c (AV positives: 1/60 scanned on 07/27/2017 14:38:26) File SHA256: 03385cbccae28797e0f6b8c1f9b55e767dad487fb652162def9f8eb7a86b29a7 (AV positives: 1/58 scanned on 07/27/2017 14:23:18) File SHA256: 72ec27bd0d959a1e6713d96b4e55c5a9b92ac6d1b5b5a4a8d5d1211422fcee57 (AV positives: 1/56 scanned on 07/25/2017 11:12:34) File SHA256: f861c5d421b4d68b8046c351c8ee9071de72b49bcc40b58baed782db07f8ba24 (Scanned on 03/21/2017 12:00:19) File SHA256: 6f7a6eb2cf3708e783156fa6fc756a3bdc05f77ee60e211ae2cd6c155be90640 (Scanned on 10/07/2016 06:49:28) File SHA256: 0d5b434b7c22b0ebe968843c03347f2060dd1286f35181f74c40b48e98b80cd8 (Scanned on 04/03/2016 05:28:36) File SHA256: 8998baa183f8f4c0779304af93493b81d4755bf1040cb94b63d8a590db236365 (Scanned on 04/03/2016 05:26:02) File SHA256: e3e617cbb31e425cc14747da5d1be3de2d5c37de6701fdb554989cc74141a0ae (Scanned on 03/28/2016 16:59:22)28:T40d,Spawned process "wscript.exe" with commandline ""C:\9f476dccaa8ed2d8ee30cea0232413c236197ad7fff59b77d266b55dbcd711d6.vbs"" (UID: 00014022-00002356) Spawned process "RgorOPoL.exe" (UID: 00014468-00003288) Spawned process "RgorOPoL.exe" (UID: 00015118-00003276) Spawned process "cmd.exe" with commandline "cmd /c %TEMP%\__t5395.tmp.bat" (UID: 00015228-00003368) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00015245-00003392) Spawned process "reg.exe" with commandline ""reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f"" (UID: 00015303-00003396) Spawned process "reg.exe" with commandline ""reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f"" (UID: 00015309-00000352) Spawned process "reg.exe" with commandline ""reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers""" (UID: 00015315-00002020) Spawned process "attrib.exe" with commandline "attrib Default.rdp -s -h" (UID: 00015321-00001724)29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiOiIiIiIh3d3eId3d4iIiHfuiIiIdnd3eIiId3N4iIh37oiIiHZ3eIh3iGgzeIiIeI7oeIh3d4iHe7dzM4iIiHiI6DdXd3d4d3uHczeIiIh4h35zN3d3eId3h3M4iIiIczd+gzN3d3iHd4gzeIiIiDM7eOczd4h4h2iHM36IZsxzeDfmNYiGZ4eIgzPuzMzMh4uLfneIZmZ4h3M37sxneIeIh3bniOZmZ2wzN46IiIgzeIOH53dmZniHM3h4iId3M4iHd+5XZmZ4hzN6p4hziHeOeDdu5mZniHMzqoiIiHjodnc2budWZogzN453eIh3h3d352ZudnaqM3fueId3dzMzMzN3bneqozN36Id3d3czeIN3fo7qo3M3d+d3h3d4N3iDdnd353czM3fnd4iHZjd4g2Z3h+53Mzd47deIiHc4iIJmh3ju4zN3d3fdiHh4OIh4aIh4jud3d3d3XdiIeHd4J4iId4ZuiIbod0V9iHh4eDeIiIeGbmd27nd3d3d3d2c3eIiHeHbnVXhzd3XXd3ZneIiIiHfX5mV3h4h1V3dmd4iIiIh33X545lVzeH13ZnOIiIiNh4h3juZ1V4d33WiDiIiN3YiIh46GiFVTdI2Id4iI3diHiIiOZmiHVzOHiHeI2IiIiIiI7nZmiIhniIiI3d2IiIiHeOiGZmiIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiOiIiIiIh3d3eId3d4iIiHfuiIiIdnd3eIiId3N4iIh37oiIiHZ3eIh3iGgzeIiIeI7oeIh3d4iHe7dzM4iIiHiI6DdXd3d4d3uHczeIiIh4h35zN3d3eId3h3M4iIiIczd+gzN3d3iHd4gzeIiIiDM7eOczd4h4h2iHM36IZsxzeDfmNYiGZ4eIgzPuzMzMh4uLfneIZmZ4h3M37sxneIeIh3bniOZmZ2wzN46IiIgzeIOH53dmZniHM3h4iId3M4iHd+5XZmZ4hzN6p4hziHeOeDdu5mZniHMzqoiIiHjodnc2budWZogzN453eIh3h3d352ZudnaqM3fueId3dzMzMzN3bneqozN36Id3d3czeIN3fo7qo3M3d+d3h3d4N3iDdnd353czM3fnd4iHZjd4g2Z3h+53Mzd47deIiHc4iIJmh3ju4zN3d3fdiHh4OIh4aIh4jud3d3d3XdiIeHd4J4iId4ZuiIbod0V9iHh4eDeIiIeGbmd27nd3d3d3d2c3eIiHeHbnVXhzd3XXd3ZneIiIiHfX5mV3h4h1V3dmd4iIiIh33X545lVzeH13ZnOIiIiNh4h3juZ1V4d33WiDiIiN3YiIh46GiFVTdI2Id4iI3diHiIiOZmiHVzOHiHeI2IiIiIiI7nZmiIhniIiI3d2IiIiHeOiGZmiIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==30:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"9f476dccaa8ed2d8ee30cea0232413c236197ad7fff59b77d266b55dbcd711d6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266220756,"unified_at":"2026-09-24T16:10:20.756Z","metadata":{"hashes":{"sha256":"9f476dccaa8ed2d8ee30cea0232413c236197ad7fff59b77d266b55dbcd711d6","sha1":"111ae1381877fa347d8b83a9ff466a604ba5a460","md5":"4519f8ec9f060f87ec85c489d591a772","sha512":"1332fad8eb007bce54a52a6cba080458eb691acfebf0ed04b3d41bdf7b7e6a649c7b34da9186459657adba51c81c8bdd5b498e8b277c87175eb0cdaa786cce6c","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"20172.2017-07-31_75.20.68.vbs","file_type":["script","vbs"],"file_type_id":"vbs","file_size":4267,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1501500968000,"last_seen":1661396458000,"last_multi_scan":1661396458000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["globeimposter","ransomware"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":25,"suspicious_count":12,"malicious_count":10,"total":47},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"JS/Obfus.S252","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/VBS.Agent.pdh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"VBS/Dldr.Kriptik.CCC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.VBS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.VBS.Agent.PD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"VBS/Downldr.HM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.VBS (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBS/TrojanDownloader.Agent.PDB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.VBS.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.VBS.Agent.cls","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"VBS/Downloader.ga","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Vbs-heuristic.druvzi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Dropper.VBS.2799","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"VBS/DownLdr-ACX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.NPE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"JS_NEMUCOD.TH731","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"JS_NEMUCOD.TH731","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"VBS.Downloader.DO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.VBS","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00014468-00003288-31658-33-03003889\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014468-00003288-31658-308-030024FB\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014468-00003288-31658-12-03004617","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00014468-00003288-31658-104-030037DF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RGOROPOL.EXE\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RGOROPOL.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)\" (SID: 2015744, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"koewege.de\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"81.169.145.77:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"wscript.exe\" created file \"%TEMP%\\RgorOPoL.exe\"\n \"RgorOPoL.exe\" created file \"%TEMP%\\__t5395.tmp.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$24","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"wscript.exe\" called \"ADODB.Stream.6.0.CreateObject\" ... \n \"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"wscript.exe\" called \"Microsoft.XMLHTTP.1.0.CreateObject\" ... \n \"wscript.exe\" called \"WScript.Shell.1.Environment\" with result: \"IDispatch\" ...\n \"wscript.exe\" called \"WScript.Shell.1(\"Environment\").Item\" with result: \"%TEMP%\\ ..., \"wscript.exe\" called \"Microsoft.XMLHTTP.1.0.open\" ... , \"wscript.exe\" called \"Microsoft.XMLHTTP.1.0.setRequestHeader\" ... , \"wscript.exe\" called \"Microsoft.XMLHTTP.1.0.status\" with result: \"200\" ..., \"wscript.exe\" called \"ADODB.Stream.6.0.Type\" ... , \"wscript.exe\" called \"Microsoft.XMLHTTP.1.0.responseBody\" with result: \"MZ\" ..., \"wscript.exe\" called \"ADODB.Stream.6.0.Write\" ... , \"wscript.exe\" called \"ADODB.Stream.6.0.SaveToFile\" ... , \"wscript.exe\" called \"WScript.Shell.1.Run\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"wscript.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"vssadmin.exe\" (UID: 00015245-00003392) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Requested access to a system service","description":"\"wscript.exe\" called \"OpenService\" to access the \"rasman\" service\n \"wscript.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"wscript.exe\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c %TEMP%\\__t5395.tmp.bat\" on 2017-7-31.12:27:02.433","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"RgorOPoL.exe\" (UID: 00014468-00003288)\n Spawned process \"RgorOPoL.exe\" (UID: 00015118-00003276)\n Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\__t5395.tmp.bat\" (UID: 00015228-00003368)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00015245-00003392)\n Spawned process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"\" (UID: 00015303-00003396)\n Spawned process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"\" (UID: 00015309-00000352)\n Spawned process \"reg.exe\" with commandline \"\"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"\"\" (UID: 00015315-00002020)\n Spawned process \"attrib.exe\" with commandline \"attrib Default.rdp -s -h\" (UID: 00015321-00001724)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"RgorOPoL.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"BazisVirtualCDBus.inf\" has type \"data\"\n \"EXPTOOWS.DLL\" has type \"data\"\n \"debugger.chm\" has type \"data\"\n \"goopdateres_bn.dll\" has type \"data\"\n \"c2.dll\" has type \"data\"\n \"c1.dll\" has type \"data\"\n \"dt_shmem.dll\" has type \"data\"\n \"dumpbin.exe\" has type \"data\"\n \"c1xx.dll\" has type \"data\"\n \"gdikdx.dll\" has type \"data\"\n \"goopdateres_en.dll\" has type \"data\"\n \"goopdateres_ur.dll\" has type \"data\"\n \"CSS7DATA000A.DLL\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"ASWhook.dll\" has type \"PGP\\011Secret Key -\"\n \"GRLEX.DLL\" has type \"data\"\n \"GoogleCrashHandler64.exe\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Executes a visual basic script","description":"Process \"wscript.exe\" with commandline \"\"C:\\9f476dccaa8ed2d8ee30cea0232413c236197ad7fff59b77d266b55dbcd711d6.vbs\"\" (UID: 00014022-00002356)","origin":"Monitored Target","relevance":10,"id":"target-17","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"wscript.exe\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"koewege.de/98wugf56?-trredfcjrottrdtwwq.net/af/98wugf56-psmsas.com/98wugf56?-gentemergente.com/98wugf56\"\n Heuristic match: \"koewege.de\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"wscript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"RgorOPoL.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"RgorOPoL.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"RgorOPoL.exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\ntuser.ini\"\n \"RgorOPoL.exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"RgorOPoL.exe\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \"RgorOPoL.exe\" read file \"%USERPROFILE%\\Saved Games\\desktop.ini\"\n \"RgorOPoL.exe\" read file \"%USERPROFILE%\\Saved Games\\Microsoft Games\\desktop.ini\"\n \"RgorOPoL.exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"RgorOPoL.exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \"RgorOPoL.exe\" read file \"%USERPROFILE%\\Links\\desktop.ini\"\n \"RgorOPoL.exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \"RgorOPoL.exe\" read file \"%USERPROFILE%\\Favorites\\Links for United States\\desktop.ini\"\n \"RgorOPoL.exe\" read file \"%USERPROFILE%\\Favorites\\Links\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"cvtres.exe\" has type \"DOS executable (COM)\"\n \"GRINTL32.DLL\" has type \"DOS executable (COM)\"\n \"hlchPBL.exe\" has type \"COM executable for DOS\"\n \"goopdateres_bg.dll\" has type \"COM executable for DOS\"\n \"dumpexam.exe\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"RgorOPoL.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"RgorOPoL.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"CERTIFICATESCHECK\"; Value: \"%PUBLIC%\\RgorOPoL.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"Found dropped filename \"dictionary.alcatel-lucent.aaa\" which has been seen in the context of ransomware (Indicator: .aaa)","origin":"Binary File","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Changes the attributes of the Desktop.rdp configuration file","description":"Process \"attrib.exe\" with commandline \"attrib Default.rdp -s -h\" (UID: 00015321-00001724)","origin":"Monitored Target","relevance":10,"id":"target-83","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"wscript.exe\" wrote bytes \"92e6227779a82777be722777d62d27771de2227705a22777bee32277616f2777684125770050257700000000ad3738778b2d3877b641387700000000\" to virtual address \"0x74871000\" (part of module \"WSHTCPIP.DLL\")\n \"wscript.exe\" wrote bytes \"4053257758582677186a2677653c27770000000000bf6b750000000056cc6b75000000007cca6b750000000037683f756a2c2777d62d27770000000020693f750000000029a66b7500000000a48d3f7500000000f70e6b7500000000\" to virtual address \"0x77411000\" (part of module \"NSI.DLL\")\n \"wscript.exe\" wrote bytes \"7739237779a82777be722777d62d27771de2227705a22777c868267757d12d77bee32277616f2777684125770050257700000000ad3738778b2d3877b641387700000000\" to virtual address \"0x74DA1000\" (part of module \"WSHIP6.DLL\")\n \"reg.exe\" wrote bytes \"4053257758582677186a2677653c27770000000000bf6b750000000056cc6b75000000007cca6b750000000037683f756a2c2777d62d27770000000020693f750000000029a66b7500000000a48d3f7500000000f70e6b7500000000\" to virtual address \"0x77411000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"attrib.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/58 Antivirus vendors marked sample as malicious (12% detection rate)\n 4/40 Antivirus vendors marked sample as malicious (10% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"malicious","category":"General","name":"Tries to delete registry keys using reg.exe","description":"Process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"\" (UID: 00015303-00003396)\n Process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"\" (UID: 00015309-00000352)","origin":"Monitored Target","relevance":5,"id":"target-24","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"wscript.exe\" wrote 32 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 1252)\n \"wscript.exe\" wrote 52 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 1252)\n \"wscript.exe\" wrote 4 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 1252)\n \"RgorOPoL.exe\" wrote 32 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 104)\n \"RgorOPoL.exe\" wrote 52 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 104)\n \"RgorOPoL.exe\" wrote 4 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 104)\n \"RgorOPoL.exe\" wrote 1024 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 104)\n \"RgorOPoL.exe\" wrote 74240 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 104)\n \"RgorOPoL.exe\" wrote 23040 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 104)\n \"RgorOPoL.exe\" wrote 6656 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 104)\n \"RgorOPoL.exe\" wrote 8704 bytes to a remote process \"%TEMP%\\RgorOPoL.exe\" (Handle: 104)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00015245-00003392)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Shows Globeimposter specific behavior","description":"The file shows various behavior artifacts extremely typical for the Globeimposter ransomware","origin":"Indicator Combinations","relevance":10,"id":"summary-19","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_ReadMe_.txt\" which has been seen in the context of ransomware (Indicator: README_.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"malicious","category":"Remote Access Related","name":"Sets terminal service related keys (often RDP related)","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\TERMINAL SERVER CLIENT\\SERVERS\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\TERMINAL SERVER CLIENT\\SERVERS\"; Key: \"(DEFAULT)\"; Value: \"0000\")","origin":"Registry Access","relevance":3,"id":"registry-60","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behavior","description":"The script produces internet activity\n is obfuscated and drops files","origin":"Indicator Combinations","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$28","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Sets terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Ransomware","details_count":3,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Shows Globeimposter specific behavior"}],"sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":83,"dropped_files_count":0,"extracted_files_count":146,"files_written_count":97,"files_deleted_count":0,"registry_keys_created_count":12,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["globeimposter","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"597f13bd7ca3e134286211f3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"VBS.Cryptoload","contacted_countries":["DEU"],"submit_name":"20172.2017-07-31_75.20.68.vbs","analysis_start_time":"2017-07-31T12:25:00+00:00","indicators_count":{"informative":25,"suspicious":18,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"81.169.145.77","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]}],"dns_resolutions":[{"domain":"koewege.de","address":"81.169.145.77","country":"Germany","registrar_organization":"STRATO AG","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]}],"http_requests":[{"host":"koewege.de","host_ip":"81.169.145.77:80","url":"/98wugf56?","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /98wugf56? HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0\nAccept-Encoding: gzip, deflate\nHost: koewege.de\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}],"processes":[{"pid":2356,"ppid":0,"name":"wscript.exe","command_line":"\"C:\\9f476dccaa8ed2d8ee30cea0232413c236197ad7fff59b77d266b55dbcd711d6.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","normalized_path":"%WINDIR%\\System32\\wscript.exe","uid":"00014022-00002356","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAA60lEQVR42s2WAQoEIQhFPXpH62YtLQRuq/WtLyTIMDFTT/taIspKKY3tErH+A9OeAAhBZADUWnGIDIBuMEQWAAyxAogony7C70TTmPXeoxxzeYHobyCAMSYdwvB5ca38awAr8raIfKh+uAURBthF7y3uQRwBnERPBUAzYM1J2YLmVIDOANobjqpAwCykAcxRW08UIgyAaCECcQTAzMQxACsTVwCMTFAAdouvIK40AF1ANz3iqgq8hvTXDZkZ2J2IenGkS9Ib0U/0GRpARGdBUKvAO2q1j/1fXUauqkCCltIJGfY+wG6vGS4v2QfvuwLxsgSoUQAAAABJRU5ErkJggg=="},{"pid":3288,"ppid":2356,"name":"RgorOPoL.exe","command_line":"","sha256":"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27","normalized_path":"%TEMP%\\RgorOPoL.exe","parent_uid":"00014022-00002356","uid":"00014468-00003288","icon":"$29"},{"pid":3276,"ppid":3288,"name":"RgorOPoL.exe","command_line":"","sha256":"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27","normalized_path":"%TEMP%\\RgorOPoL.exe","parent_uid":"00014468-00003288","uid":"00015118-00003276","icon":"$2a"},{"pid":3368,"ppid":3276,"name":"cmd.exe","command_line":"cmd /c %TEMP%\\__t5395.tmp.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015118-00003276","uid":"00015228-00003368","icon":"$2b"},{"pid":3392,"ppid":3368,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00015228-00003368","uid":"00015245-00003392","icon":"$2c"},{"pid":3396,"ppid":3368,"name":"reg.exe","command_line":"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00015228-00003368","uid":"00015303-00003396","icon":"$2d"},{"pid":352,"ppid":3368,"name":"reg.exe","command_line":"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00015228-00003368","uid":"00015309-00000352","icon":"$2e"},{"pid":2020,"ppid":3368,"name":"reg.exe","command_line":"\"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00015228-00003368","uid":"00015315-00002020","icon":"$2f"},{"pid":1724,"ppid":3368,"name":"attrib.exe","command_line":"attrib Default.rdp -s -h","sha256":"db24550c3183fc38f9440134322f124447dfe0a3564490180418305d7899d159","normalized_path":"%WINDIR%\\System32\\attrib.exe","parent_uid":"00015228-00003368","uid":"00015321-00001724","icon":"$30"}],"all_imported_dlls":["scrobj.dll","vsstrace.dll","lpk.dll","msado15.dll","urlmon.dll","profapi.dll","pnrpnsp.dll","cfgmgr32.dll","Wldap32.dll","IPHLPAPI.DLL","rtutils.dll","npmproxy.dll","winbrand.dll","vssapi.dll","msdart.dll","rasapi32.dll","WSHTCPIP.DLL","normaliz.dll","mlang.dll","devobj.dll","usp10.dll","msctf.dll","netprofm.dll","dhcpcsvc.dll","propsys.dll","atl.dll","ulib.dll","rasman.dll","KernelBase.dll","ole32.dll","shell32.dll","msxml3r.dll","ntdll.dll","dwmapi.dll","clbcatq.dll","crypt32.dll","wshext.dll","comctl32.dll","winrnr.dll","wship6.dll","msvcrt.dll","version.dll","msisip.dll","shlwapi.dll","scrrun.dll","dhcpcsvc6.dll","setupapi.dll","nsi.dll","sxs.dll","vbscript.dll","sspicli.dll","ntmarta.dll","ws2_32.dll","nlaapi.dll","user32.dll","cryptbase.dll","mpr.dll","NapiNSP.dll","msasn1.dll","rpcss.dll","uxtheme.dll","cryptsp.dll","SensApi.dll","wininet.dll","mswsock.dll","vss_ps.dll","sechost.dll","oleaut32.dll","msxml3.dll","iertutil.dll","winnsi.dll","advapi32.dll","rpcrt4.dll","rsaenh.dll","RpcRtRemote.dll","FWPUCLNT.DLL","dnsapi.dll","imm32.dll","wintrust.dll","rasadhlp.dll","apphelp.dll","kernel32.dll","gdi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"GlobData","sha256":"5b14cb76c8b3387d1c34ca3e14a30b584351910bc561dca9918154dcf325c974","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GlobSettings","sha256":"f26fbe217d761559bd7307e401a38d1817b22474938ba5f3e344d33384fdffa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"16c794bb69011981faded3aaea27b0979f47feadb099e77eeb1cdbdad9a1976c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"f09d6dbf2111c9456cc6c7268ebb7996d8acab2bfe17dcb535c1892753af7e2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"addressbook.acrodata","sha256":"843721c0ff3816845bdea26eec60bdaab893de68356a05cc4033159b6cca41f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"directories.acrodata","sha256":"dab4ffeaa1f5e560edcc81783cf1e0d200efa5b082fcebbc79963fe2fe10e8ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"addons.json","sha256":"e332baa72ce29e898da99c5b82ca6a42f8ca9ae7f6c67ea65ad566ac05d110c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"blocklist.xml","sha256":"6bc4c75ef54c96ad854163f79932e952bcc497393bcb9c55dc89b355ab28d026","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"cert8.db","sha256":"38538282f9ed6c5d29b1986c24c4f37347123e74feb9030df000b0a75a20f493","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"compatibility.ini","sha256":"e716dd62bd8ec047dd6cee56bdebc2f140e156de6015ff31dd23eaeba42e4c90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"content-prefs.sqlite","sha256":"c470e46fb8343fbfc89337fab78187bfbfd8468f784cf698cc4de8bc2e9f331a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"extensions.ini","sha256":"007f7f44a3a7afc1fa2aa5ec10884a9109dba578b570ad2af94c46730a3a2d55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"formhistory.sqlite","sha256":"92aaa0b61ad4fe24f766030184ca97a1f1ec500a66f92526e0ae2bd8de0eb01a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"healthreport.sqlite","sha256":"c55731044231ba8a1d5d6bbb0bde18e9586a80c02f2d2b42b099ff47c3cac0e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"818200132aebmoouht.sqlite","sha256":"42b61f44221046b131e8504874a842253c65b2dd6552b973b22b6bf521b59a83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"98wugf56[1].txt","sha256":"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"baseline.versions","sha256":"7cac2661da9966543389660d4772959ffda9f52ce6ff6ec08f0123831758fc1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"blacklisted.certs","sha256":"6e0cfefa333a105b337a5cc30b462e2ae885bcd50a419140d03108a02e16c8c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"{e29ac6c0-7037-11de-816d-806e6f6e6963}","sha256":"84b03c088af03786361f66ead7a7d48bc5f401a096a5e229766942fe7a816fd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Calculator.lnk","sha256":"ea3df090b1fbac59316b94788d07c0a14143cd9a979091356c3a57c7f2c843db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"08d3aabfec2c7bd4f067a2b38ea739a17bd0872c2b0f78577c24e48a0ac236f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"0zIG0D.doc","sha256":"3609ef6e882cef1739d190a954e4e960e8fab56a2feed79a696e67a56578120c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"8e2038ad900f52c5872cc792f4ac8452467c5ae14f06072d7c255bacbbca8dcc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"6SZfLTu9z.doc","sha256":"a8348c070b1af54937ce0ae67deec9095dc794c8f6d1a4f115236185abf72c66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"6e54fd93ea2b4cdbb027e4946e63ff9479108d3e66b888a6a3a381ea461dfea4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"EKeaJO.doc","sha256":"8d846352d66b64b866e4ebf470b0b59e6a4bcf383a8b066bef26315d9b5d49c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"F3hzum1.doc","sha256":"071138601c952fd49017e6cf93842b4c8e10721c9d77fd5369d92938d0e7f600","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"dH1rDN9f9.doc","sha256":"4be17167aadebae86c4d2e0036d777398d6159f92f9267bf8d21e0c1bf3a1328","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"dskCEJ.exe","sha256":"1a1ec3fe720c8dabf991b00cc1f37a87fa00e59017c890ad522fc445a40ffa4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"hKY8.doc","sha256":"1bd4d6228f807dd7f5d0a5120b2090794749c587350dc451a6c3da44cb46da06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"hlchPBL.exe","sha256":"b6a56dd97d58849a84b105bef1f136e44208f59fa2c455969bd53dc80fd28064","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Desktop.lnk","sha256":"7286c5e97f29b4d1384b1107ce315f2c64314553b3993ba18c5dcbdec36b138f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"autoexec.bat","sha256":"d052f8bc08133c35238d85b506c4cc9baa716b78fa87157824d731816f740f7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"BazisVirtualCDBus.inf","sha256":"500d7b172f77fcc2ef7fafcc3009c86061c837a2f38bf97d80d77acc5fff098e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"EXPTOOWS.DLL","sha256":"1fb3a3f8c2a51a78b3b15050c670af4597e2d1d4b38a99f3d6dd8215ee184236","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"debugger.chm","sha256":"5a17f776524216d4deabe884e8ef6efef068543300400399849d021d01c3fc95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_bn.dll","sha256":"412340b1a5b686770d9acd4ef4af66583ada5a9bf406cbac64ae6a55776bef3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"c2.dll","sha256":"195fb887ddc47772b76a759f353b45fd73dd63acefd80ca0c218be00f2f84ef2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"c1.dll","sha256":"6afed9d684ee525aa0662f4caff75b28b48cca7eb1433b328b88fed2a554e96e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"dt_shmem.dll","sha256":"5c572499437b07ca936f7f0428937749bdf5780b238f814c18afbc55fdfe3516","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"dumpbin.exe","sha256":"f0b95a36224d212d66a6cf23f50bd36f40c707ed1f4f9370b97a8822357eabde","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"c1xx.dll","sha256":"904c7aac146b2d84b84dfdffa222757d367ca48c0f2dc0694f1f1bc885de11e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"gdikdx.dll","sha256":"200a87866e75cf0cec3ecb5721466eddc69b250f195fb29fa0c634fc955c1c98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_en.dll","sha256":"d8306f29c0156468b3177667df6aac7f4b89708f4ceaebd221f4d8b35b2b3db7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_ur.dll","sha256":"cf86109a9bdbfd45a899b083232b7d9c573e9c9136a869878a1595dea488e2f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"CSS7DATA000A.DLL","sha256":"697285de3dfebac31c6de18515d4207a77d8c4872a927a89a55ae1ffda8aaefc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ASWhook.dll","sha256":"1e46c2a5ac8de29dd685667899df0adee2c37dc947e9e49837c1d2b4dc38911d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GRLEX.DLL","sha256":"0cf776f942e21ceb12e548826be2dbab09c304877340342aad3b65c67c8c4d1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GoogleCrashHandler64.exe","sha256":"d828f277c9418f5d0fa8823c3cd969541993729d433ec6503e979056810dc077","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_fil.dll","sha256":"625466db88078159eb9c6d292f44f40a5d29247f8ce7c51b6b9464a17d7cb314","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"cvtres.exe","sha256":"771a74f340b1f682c0bdca6c481432b25d1deb89f1f3cde133a6888e8aa228d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"1394dbg.cat","sha256":"a829da8b022284b601237ae0746c66a22efa97a1843ae832dd73b323b8a7a962","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Au3Check.exe","sha256":"22eca93de851e3da30446bbf9d20ceedc16cc06452e8bbcb178fbd023dae4d7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_nl.dll","sha256":"d623ecfb03fae8d1ed026ab5bf55151ac3f14ddf406e85a0d40b726f891e75d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"agestore.exe","sha256":"3c347494bb860534e7ceaec967aaa318f9465c45ff8528c900c0174add323a25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"dnsns.jar","sha256":"fa94160779811dff784729939783c00e1e8406602e8f4665880a940a0b9234aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"glass.dll","sha256":"863f1bd17a563cb43a5cd9494d9180bdc914a325917fdae7cdacbfa3c2f7720e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"dbghelp.dll","sha256":"c233893a5048bc6d1212637555508ada938e36c1d908411943c27b96ba3dc09e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdate.dll","sha256":"84059858564e7672550093b337d49ffa4ac2c0d362aa010600a8887309c13f40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"fltkd.dll","sha256":"c753a5ad9f14ed112cce892bdb88f4666f18ddb5e51bcda2949c1fd51cd57298","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"gflags.exe","sha256":"f431839411bab4775b529415b8a2b7f27e002d3e6e751bbb6d6038f6cde44d00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_sk.dll","sha256":"d52180b9d1ee72ac79a9b6d3c52de2b34e3174492881e2bd836898d505aca2c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_pt-BR.dll","sha256":"e7ec4a0e54259b93a9450e7e573ce40e7ef0393534b4a7a58673304195d6df05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"chkrzm.exe","sha256":"a29c7774f7675c33647d99c8097c9687566fc4a2d2b950cdf1501cd9db4e1a23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GoogleUpdateWebPlugin.exe","sha256":"ba74cd7a75d07804aa77fa73ebb315d99ba397fb12675be40e85bfff34253444","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"EMSMDB32.DLL","sha256":"a1e79b270eac415187c64550b056623c24a2c9115c54f54d511a59fa2f23e0fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"cvsindex.cmd","sha256":"739d4de98239207e34a5ff4989473e0fe2f3386656ef9ac13d2f1c7043cfef52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"adplus.vbs","sha256":"3031a33085830ee1b0772f2948e8da89b16481d8a3abc379eaefa2fe8ccf7727","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_te.dll","sha256":"310d89c819d68553e01b7273e399e5a4f2278caa62905a97bd8353ce4667ca8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_en-GB.dll","sha256":"9dc8e5feb78d77be779db8ac292529a819fc3cc75a6c2341e7aa2fdca702dd0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ext.dll","sha256":"814de34b5d41145243f0155f6c7d7a48c9d941efdf9c1ad20ffa07bec5ee4feb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GRINTL32.DLL","sha256":"7c7e51023718c2291d6c9222a37d977ffb5d0e277f5b6d68ef59de619d65fe04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_hu.dll","sha256":"c023a5e9be9a50fe50dede70e3f23e49ab520952b4910ee4fb6c63dc4f0773c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"AUDIOSEARCHSAPIFE.DLL","sha256":"667666adb2baa6076eeeff97b96cf0fadea2ac6e8a4f10d813dee682c34cae49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Google Chrome.lnk","sha256":"64a048bdfd9e2fd7de018d52e5a66ac78fb1e6a59b5c2b601595cb068f533387","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"acpikd.dll","sha256":"c43b63e8567d4fa41dc33f4903b8cf92133a66ec0bd0e3af7605a891987dae48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"AcroRead.msi","sha256":"4b424470880d3f034f511c2ac670e3f788040ed8223fcfd1b3495bcc6539be2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"fontmanager.dll","sha256":"31b6ece115d343204460c1106c7f6a21e1ca0585f41b05643137d2f98beb806b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"FreeCell.exe","sha256":"3ef7d86dea2ea2b1d40a7aaa198c4015dc1283aabb64b154b8710fedb873c53c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GoogleUpdateHelper.msi","sha256":"3ba927e0d1d6858ecc992e6ff9c9c7b0ea3f2b19f265f16feae90355d41c0f0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"AUDIOSEARCHLTS.DLL","sha256":"7e7a3ad376467da8b5fb1f370aa2402dc226bd8d143ac0eca5484952882899f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"dbgrpc.exe","sha256":"68c761a05381ca4ae0749cf4a27d39b5aca9e56dea4fea91ea8c11981b24e1c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_sw.dll","sha256":"4187663b98cc26641942db9fc31d2751cf6564d640be6bbe0a4615cdbca19bfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_th.dll","sha256":"3036881ff2f92a7f66fbda78abc9f1af81d188f2ea1df68bde5e142b9b485ebf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"FORM.DLL","sha256":"1c29e6ec89ea0e82f29d0899e72ac3ceb051cec54f4d8300f712f9aefefef03c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ContactPicker.dll","sha256":"fb693b84f0b01827f03013e67bdbfdf68cfbddc183c215c5487de442a3ac497b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"charsets.jar","sha256":"401879b4448683ebb97b4ef8acba98d329b1f284b622f6ae5cf80cb02e153da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_ko.dll","sha256":"320658a206de2493a0ff71d8d3c1cc301a3b38bad155b3ce6f28003e6dbd44bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_sr.dll","sha256":"26c452a295a94a38f129b533e54862be5130b4ea62e8096a2fe0e12f6762e5f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"awt.dll","sha256":"be9fdadfd88b30c7859ad6bb72eba6b15c43998a5a5f671604d385500ff29f1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"eula.dll","sha256":"94ba65277869d7bc27b7c21639e2a5d4015325b9a1ab67f0f9635489ae665ed6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_bg.dll","sha256":"376a32153c63e599f96d458ea533fa4c503dda414d29ea94aac0d27cbf75fec7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"dumpexam.exe","sha256":"fae485beb8aff10ef6639b2eb6a56f9a89dbc766cefb89752cbeda9f00e53ddd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"glib-lite.dll","sha256":"419b46d022ef003f7d0d7eafc6d6fb457582529c6174bd58d242dd9c158c833c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GoogleCrashHandler.exe","sha256":"c7a8a3c7b95481e3ee10d7a312708491f74eaf4663a3b9044281ecc5d903ab89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"bazisvirtualcdbus.cat","sha256":"a930b5cc5e916d6598572b4b5d90115498df0d996cd37b59326669bc929c9312","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_tr.dll","sha256":"6d3345c484075cfc791d8f6284fa207bf82b3452268d4a8c8b3d35cae6a50d33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Au3Record.exe","sha256":"174230636c8cd63425b69143e84fb10363b8508485193b3bc22421577b2604bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GKExcel.dll","sha256":"774104857165a57b0cff87906ec2be6ec30fd5ee3b03711d50bdd849a321f6ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"CDLMSO.DLL","sha256":"6368893358f8b2bcbe07f75878a947c29fd99831b59363daee97ef5280d8f1df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_da.dll","sha256":"1aee1df3443f04568df90f5ce71e357628a5ecff469ffe0c68939e29c8e6be92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"access-bridge.jar","sha256":"3ae736a8a0a7b5aa7c99ec01bb34b560d24c6b6b29adb7902c71f1556e85e966","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_ar.dll","sha256":"c5ebad1aa31382125e2f43b53da4d1c1cf610a41264741dc2552991727a2fdef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"BULLETS.DLL","sha256":"1b1efd3e7b2e8bf090d2448d5bd9093f803459ae82d01f48b26ecd81911a133f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"CERTINTL.DLL","sha256":"459fad65fde44615ff943feeb674ea56288c8baf5e4c9fa96e360e4de7af61a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"fxplugins.dll","sha256":"80c0cf8775eba8deb9c5fb17b28ed0009016b82dcdb312bd41820880c30dae2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GoogleUpdateCore.exe","sha256":"d3ba17e3598346551cd30d9a11f8d885ddcf4732c5c56465845345dacd224c47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"bckg.dll","sha256":"a9e2a7e5680b97cab2f7bfd7029bdc90b5b61425b7fbdc58cbe56203daa7a117","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_is.dll","sha256":"3922fc095c2dee55dae02307dceab0314559bf2f623c5db4490a173fd9cad21a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Chkr.dll","sha256":"79640ea314645bd8273d1c1e105f6cc9c0776db9c6e872da1f9d196e72a23a2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_sl.dll","sha256":"e28033ddca58de7b318e00dcd2c84c453a4d043dba4e29f3b9d2f6edb2a79a32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"CONTAB32.DLL","sha256":"7edc57af0247e064870756a685294eb882ca9037d253739fe50e35d8144b0ef2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GoogleUpdateComRegisterShell64.exe","sha256":"06eafc037ff726e810e981a5aeed0cc836f52758419cc21909da353f9ba6a511","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"GoogleUpdateBroker.exe","sha256":"f74e8e68d19413afc6ee0e6847fe9190d4ad0cac3220d80c30533b1074e56fe8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"FreeCellMCE.lnk","sha256":"291404e20ec8471c0aa06ba8a343ae6480b545e16cf655d53d3bb1c5b19479db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_no.dll","sha256":"465622aed25086c4df4da315e2f012a0dff4ef8d9d310e597310f76057fe8f84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ContactPickerIntl.dll","sha256":"88e134fabffd11b4119231e2127160e4512c4a87d8e3e402fad36b878d7c0130","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ENVELOPR.DLL","sha256":"8e776d28c09dc6c46c3668f92fd4d91637be1f5c92fc30896e3949ad48eed0b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"EAWFINTL.DLL","sha256":"7ffb1b7ae8a432ab09043bd75c94a074c1b3eca4bb2c1029171abd536d310479","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"exts.dll","sha256":"f53495da51dea2f8db2a2c3845af8467e76ca72e2ec5c7ed126d798a9e84a4f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_kn.dll","sha256":"cc742e6da9c7e23147daca74b1bc93dfeaeefc3b97cf5d6a276ecc875923e645","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"goopdateres_pl.dll","sha256":"9369fbaf7c896d7bcfac6b725a6347e5ee780acfe0de3d0da7e373f58b646d03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ApothecaryMergeLetter.dotx","sha256":"43420c4d55682be4a27c853476e0aad0bd5c48bbc8c8b23abb8deb3a06bca851","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"AdjacencyLetter.dotx","sha256":"ac40a1851f03b6bc28d9be3e2cd2cca75c036ce849f652d5d91326d6858880a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ExecutiveNewsletter.dotx","sha256":"e5428fdac61f0d553f35a31233b5ed627649f5ffdd6d83b8a204dfc386bc8ae9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ExecutiveLetter.dotx","sha256":"2e57d5d0a85a4fe42a5b26488fb6a26342b65ea645938aaa55e47f00a481ed7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"FUNCRES.XLAM","sha256":"78e6049d7ae94454138645debd51481cffedee27137fcfe7d8ad719f00258a3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"AdjacencyMergeLetter.dotx","sha256":"bcba01b8eb604ba8dfc7cbd8905f4d2a93ed9869d10da6dd009e27664f070d3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ExecutiveResume.dotx","sha256":"912822805c0c315ff2bb03057a6db53578c3e16719861b1db73f256fedacde37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Fancy.dotx","sha256":"b957b36fca23526b4e116212877426a44a6627e0d3473cdc67e41c99f9be607d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"BloodPressureTracker.xltx","sha256":"1a0458a0df97707c58078b528f1c394836f78e95f31af2af08d6d7c27b843276","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ContemporaryPhotoAlbum.potx","sha256":"a66709d8e8fd13e7c9973958fd76b6df17c00d80b43bfbe1d54222d498b50f40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ApothecaryNewsletter.dotx","sha256":"5869ab294b88ee5317b0cb3f00effd92ff0cc5ebb1dff064280398e66f4463f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ExpenseReport.xltx","sha256":"a4765447a9a4c7a7dbb9e899e255baae1d0f042a3a402ca57af5e447e6d14cd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ExecutiveMergeLetter.dotx","sha256":"f7f2ce9a272f94c72cfb9888177ccbf1dea07db662464b4515adfeb3c9a553fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"EquityReport.Dotx","sha256":"107de99cca822efb672d2239aea799a7ceeca8cd1131c224422d6b96fd075395","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"EssentialResume.dotx","sha256":"9673ff20643e93ab5f5d2da39a7f328a0fb526fbf70d7bf3ff1b5d37c9f858c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"EquityLetter.Dotx","sha256":"0e01b9c66f0b702a9f67efc8c0cc989da56bc2db33542a842d379e27b55a6e5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"EquityResume.Dotx","sha256":"21b53a5ee774751fae7a49c518526b753b2039cb520b9baaac10734ed60457c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ATPVBAEN.XLAM","sha256":"f7e6e8e9a5cc5c90b33539bc2911387bf935eff10421cf259c4195420aab374b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"ApothecaryLetter.dotx","sha256":"c64f1ccef298798f3cc570c6424929c742449194d9fea3e55371709ed3f69009","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"AdjacencyResume.dotx","sha256":"03b3613c09a441baeeb2a1e9533b2a0f850834bbcf63d1bca8fef8e5300f3fa0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"EssentialMergeLetter.dotx","sha256":"1fcaae45f4fd00e3f534a4e21009124a41dbb377c7c4622a678e41497f53105d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"EquityMergeFax.Dotx","sha256":"4f5de4b4018d05339a10cba128cf38ef5fe6e808477685fd23297938e3853e56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Classic.dotx","sha256":"57ba10d3acac1ea93298d0b38b1072517040a66e48d141cb5aa79026a65476cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"name":"Formal.dotx","sha256":"89ed3cf1604b131d8acd3045228be2529824c7d20b2d24e74804a18d89678a07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\WScript.exe.mui","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\System32\\WScript.exe","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\98wugf56[1].txt","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%COMMONPROGRAMFILES%\\System\\ado\\msado15.dll","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\System32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%TEMP%\\RgorOPoL.exe","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%PUBLIC%\\RgorOPoL.exe","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%TEMP%\\__t5395.tmp","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"%PUBLIC%\\{e29ac6c0-7037-11de-816d-806e6f6e6963}","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"C:\\1501500320789$OK","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"C:\\AjT.q4Y","sources":[{"report_type":"sandbox","report_id":"597f13bd7ca3e134286211f3"}]},{"path":"C:\\<<