23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T489,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample adcced3025b5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample adcced3025b5…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 11 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27"],"about":{"@type":"SoftwareApplication","name":"98wugf56.exe","applicationCategory":["peexe","executable"],"identifier":"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T6a5,"" opened "C:\autoexec.bat" with delete access "" opened "C:\config.sys" with delete access "" opened "C:\Users\desktop.ini" with delete access "" opened "%PUBLIC%\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\Sample Videos\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\Sample Videos\Wildlife.wmv" with delete access "" opened "%PUBLIC%\Recorded TV\desktop.ini" with delete access "" opened "%PUBLIC%\Recorded TV\Sample Media\desktop.ini" with delete access "" opened "%PUBLIC%\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "" opened "%PUBLIC%\Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Desert.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Koala.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Penguins.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Tulips.jpg" with delete access25:T471,"" wrote 32 bytes to a remote process "C:\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe" (Handle: 104) "" wrote 52 bytes to a remote process "C:\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe" (Handle: 104) "" wrote 4 bytes to a remote process "C:\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe" (Handle: 104) "" wrote 1024 bytes to a remote process "C:\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe" (Handle: 104) "" wrote 74240 bytes to a remote process "C:\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe" (Handle: 104) "" wrote 23040 bytes to a remote process "C:\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe" (Handle: 104) "" wrote 6656 bytes to a remote process "C:\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe" (Handle: 104) "" wrote 8704 bytes to a remote process "C:\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe" (Handle: 104)26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiOiIiIiIh3d3eId3d4iIiHfuiIiIdnd3eIiId3N4iIh37oiIiHZ3eIh3iGgzeIiIeI7oeIh3d4iHe7dzM4iIiHiI6DdXd3d4d3uHczeIiIh4h35zN3d3eId3h3M4iIiIczd+gzN3d3iHd4gzeIiIiDM7eOczd4h4h2iHM36IZsxzeDfmNYiGZ4eIgzPuzMzMh4uLfneIZmZ4h3M37sxneIeIh3bniOZmZ2wzN46IiIgzeIOH53dmZniHM3h4iId3M4iHd+5XZmZ4hzN6p4hziHeOeDdu5mZniHMzqoiIiHjodnc2budWZogzN453eIh3h3d352ZudnaqM3fueId3dzMzMzN3bneqozN36Id3d3czeIN3fo7qo3M3d+d3h3d4N3iDdnd353czM3fnd4iHZjd4g2Z3h+53Mzd47deIiHc4iIJmh3ju4zN3d3fdiHh4OIh4aIh4jud3d3d3XdiIeHd4J4iId4ZuiIbod0V9iHh4eDeIiIeGbmd27nd3d3d3d2c3eIiHeHbnVXhzd3XXd3ZneIiIiHfX5mV3h4h1V3dmd4iIiIh33X545lVzeH13ZnOIiIiNh4h3juZ1V4d33WiDiIiN3YiIh46GiFVTdI2Id4iI3diHiIiOZmiHVzOHiHeI2IiIiIiI7nZmiIhniIiI3d2IiIiHeOiGZmiIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiOiIiIiIh3d3eId3d4iIiHfuiIiIdnd3eIiId3N4iIh37oiIiHZ3eIh3iGgzeIiIeI7oeIh3d4iHe7dzM4iIiHiI6DdXd3d4d3uHczeIiIh4h35zN3d3eId3h3M4iIiIczd+gzN3d3iHd4gzeIiIiDM7eOczd4h4h2iHM36IZsxzeDfmNYiGZ4eIgzPuzMzMh4uLfneIZmZ4h3M37sxneIeIh3bniOZmZ2wzN46IiIgzeIOH53dmZniHM3h4iId3M4iHd+5XZmZ4hzN6p4hziHeOeDdu5mZniHMzqoiIiHjodnc2budWZogzN453eIh3h3d352ZudnaqM3fueId3dzMzMzN3bneqozN36Id3d3czeIN3fo7qo3M3d+d3h3d4N3iDdnd353czM3fnd4iHZjd4g2Z3h+53Mzd47deIiHc4iIJmh3ju4zN3d3fdiHh4OIh4aIh4jud3d3d3XdiIeHd4J4iId4ZuiIbod0V9iHh4eDeIiIeGbmd27nd3d3d3d2c3eIiHeHbnVXhzd3XXd3ZneIiIiHfX5mV3h4h1V3dmd4iIiIh33X545lVzeH13ZnOIiIiNh4h3juZ1V4d33WiDiIiN3YiIh46GiFVTdI2Id4iI3diHiIiOZmiHVzOHiHeI2IiIiIiI7nZmiIhniIiI3d2IiIiHeOiGZmiIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266287794,"unified_at":"2026-09-24T16:11:27.794Z","metadata":{"hashes":{"sha256":"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27","sha1":"203fc080b99bcdaf883b620b4aa4c380586ba1b5","md5":"75876717abb6ae282c97a2da6d7d8a1f","sha512":"04caf6367f0505d3135a2ec7d68b40d8782c68260b75764f550f8f783335b6b032365491fba95dca0f6715ebb0d6a8941518049cea11a8cf549f77d4cd4bcddc","ssdeep":"3072:gCbiFuKJbiw704YbqMCjserDI2ccETY7rnUxJzOSMQTqDr5wjhGthXGsvmhFb:gCbiFszb9GsevIxFTsrniZOS29f1Uh","ssdeep_chunks":["3072:gCbiFuK","3072:CbiFuKJ","3072:biFuKJb","3072:iFuKJbi","3072:FuKJbiw","3072:uKJbiw7","3072:KJbiw70","3072:Jbiw704","3072:biw704Y","3072:iw704Yb","3072:w704Ybq","3072:704YbqM","3072:04YbqMC","3072:4YbqMCj","3072:YbqMCjs","3072:bqMCjse","3072:qMCjser","3072:MCjserD","3072:CjserDI","3072:jserDI2","3072:serDI2c","3072:erDI2cc","3072:rDI2ccE","3072:DI2ccET","3072:I2ccETY","3072:2ccETY7","3072:ccETY7r","3072:cETY7rn","3072:ETY7rnU","3072:TY7rnUx","3072:Y7rnUxJ","3072:7rnUxJz","3072:rnUxJzO","3072:nUxJzOS","3072:UxJzOSM","3072:xJzOSMQ","3072:JzOSMQT","3072:zOSMQTq","3072:OSMQTqD","3072:SMQTqDr","3072:MQTqDr5","3072:QTqDr5w","3072:TqDr5wj","3072:qDr5wjh","3072:Dr5wjhG","3072:r5wjhGt","3072:5wjhGth","3072:wjhGthX","3072:jhGthXG","3072:hGthXGs","3072:GthXGsv","3072:thXGsvm","3072:hXGsvmh","3072:XGsvmhF","3072:GsvmhFb","6144:gCbiFuK","6144:CbiFuKJ","6144:biFuKJb","6144:iFuKJbi","6144:FuKJbiw","6144:uKJbiw7","6144:KJbiw70","6144:Jbiw704","6144:biw704Y","6144:iw704Yb","6144:w704Ybq","6144:704YbqM","6144:04YbqMC","6144:4YbqMCj","6144:YbqMCjs","6144:bqMCjse","6144:qMCjser","6144:MCjserD","6144:CjserDI","6144:jserDI2","6144:serDI2c","6144:erDI2cc","6144:rDI2ccE","6144:DI2ccET","6144:I2ccETY","6144:2ccETY7","6144:ccETY7r","6144:cETY7rn","6144:ETY7rnU","6144:TY7rnUx","6144:Y7rnUxJ","6144:7rnUxJz","6144:rnUxJzO","6144:nUxJzOS","6144:UxJzOSM","6144:xJzOSMQ","6144:JzOSMQT","6144:zOSMQTq","6144:OSMQTqD","6144:SMQTqDr","6144:MQTqDr5","6144:QTqDr5w","6144:TqDr5wj","6144:qDr5wjh","6144:Dr5wjhG","6144:r5wjhGt","6144:5wjhGth","6144:wjhGthX","6144:jhGthXG","6144:hGthXGs","6144:GthXGsv","6144:thXGsvm","6144:hXGsvmh","6144:XGsvmhF","6144:GsvmhFb","3072:gCbiFsz","3072:CbiFszb","3072:biFszb9","3072:iFszb9G","3072:Fszb9Gs","3072:szb9Gse","3072:zb9Gsev","3072:b9GsevI","3072:9GsevIx","3072:GsevIxF","3072:sevIxFT","3072:evIxFTs","3072:vIxFTsr","3072:IxFTsrn","3072:xFTsrni","3072:FTsrniZ","3072:TsrniZO","3072:srniZOS","3072:rniZOS2","3072:niZOS29","3072:iZOS29f","3072:ZOS29f1","3072:OS29f1U","3072:S29f1Uh"],"imphash":"e3071eb90719dea866d7e32cff72861c"},"file_info":{"file_name":"98wugf56.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":274432,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1501503359000,"last_seen":1677867699000,"last_multi_scan":1677867699000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["globeimposter","ransomware"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":13,"malicious_count":11,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Injector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Kryptor.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.39994","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/GlobeImposter.ZWHC-5269","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.39994 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.DQHU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005135de1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt.ewt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic trojan.g","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.ermspo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Emotet-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.Androm.274432.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.A4F0DDEC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.A4F0DDEC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GlobeIMP2.F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Androm.Win32.45043","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00013948-00002984-46595-12-03004617\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013948-00002984-46595-33-03003889\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013948-00002984-46595-308-030024FB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00013948-00002984-46595-104-030037DF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\__t3BF4.tmp.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c %TEMP%\\__t3BF4.tmp.bat\" on 2017-7-31.13:03:08.457","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00014538-00002952)\n Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\__t3BF4.tmp.bat\" (UID: 00014627-00003072)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00014642-00003192)\n Spawned process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"\" (UID: 00014685-00003312)\n Spawned process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"\" (UID: 00014693-00003236)\n Spawned process \"reg.exe\" with commandline \"\"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"\"\" (UID: 00014695-00003288)\n Spawned process \"attrib.exe\" with commandline \"attrib Default.rdp -s -h\" (UID: 00014700-00003260)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"BazisVirtualCDBus.inf\" has type \"data\"\n \"EXPTOOWS.DLL\" has type \"data\"\n \"MSOUC.EXE\" has type \"data\"\n \"MSSP7ES.DLL\" has type \"data\"\n \"c2.dll\" has type \"data\"\n \"OUTLPH.DLL\" has type \"data\"\n \"c1.dll\" has type \"data\"\n \"liblzma-5.dll\" has type \"data\"\n \"dumpbin.exe\" has type \"data\"\n \"c1xx.dll\" has type \"data\"\n \"libpangowin32-1.0-0.dll\" has type \"data\"\n \"CSS7DATA000A.DLL\" has type \"data\"\n \"libfontconfig-1.dll\" has type \"data\"\n \"jsse.jar\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"libatk-1.0-0.dll\" has type \"data\"\n \"MCPS.DLL\" has type \"PGP\\011Secret Sub-key -\"\n \"GRLEX.DLL\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Recorded TV\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Recorded TV\\Sample Media\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"hlchPBL.exe\" has type \"COM executable for DOS\"\n \"IMPMAIL.DLL\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"CERTIFICATESCHECK\"; Value: \"%PUBLIC%\\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"Found dropped filename \"dictionary.alcatel-lucent.aaa\" which has been seen in the context of ransomware (Indicator: .aaa)","origin":"Binary File","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Remote Access Related","name":"Changes the attributes of the Desktop.rdp configuration file","description":"Process \"attrib.exe\" with commandline \"attrib Default.rdp -s -h\" (UID: 00014700-00003260)","origin":"Monitored Target","relevance":10,"id":"target-83","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$24","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe.bin\" claimed CRC 285905 while the actual is CRC 289424","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n VirtualProtect\n IsDebuggerPresent\n GetCommandLineW\n UnhandledExceptionFilter\n GetStartupInfoW\n GetProcAddress\n LoadLibraryW\n WriteFile\n GetModuleHandleW\n TerminateProcess\n Sleep\n GetTickCount\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"reg.exe\" wrote bytes \"4053897758588a77186a8a77653c8b770000000000bf12760000000056cc1276000000007cca1276000000003768c5756a2c8b77d62d8b77000000002069c5750000000029a6127600000000a48dc57500000000f70e127600000000\" to virtual address \"0x779B1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"attrib.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%PUBLIC%\\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/64 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/64 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"16/64 Antivirus vendors marked spawned process \"\" (PID: 2952) as malicious (classified as \"ML.Attribute\" with 25% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"General","name":"Tries to delete registry keys using reg.exe","description":"Process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"\" (UID: 00014685-00003312)\n Process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"\" (UID: 00014693-00003236)","origin":"Monitored Target","relevance":5,"id":"target-24","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$25","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00014642-00003192)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Shows Globeimposter specific behavior","description":"The file shows various behavior artifacts extremely typical for the Globeimposter ransomware","origin":"Indicator Combinations","relevance":10,"id":"summary-19","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"Remote Access Related","name":"Sets terminal service related keys (often RDP related)","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\TERMINAL SERVER CLIENT\\SERVERS\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\TERMINAL SERVER CLIENT\\SERVERS\"; Key: \"(DEFAULT)\"; Value: \"0000\")","origin":"Registry Access","relevance":3,"id":"registry-60","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00013948-00002984)\n Spawned process \"\" (UID: 00014538-00002952)\n Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\__t3BF4.tmp.bat\" (UID: 00014627-00003072)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00014642-00003192)\n Spawned process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"\" (UID: 00014685-00003312)\n Spawned process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"\" (UID: 00014693-00003236)\n Spawned process \"reg.exe\" with commandline \"\"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"\"\" (UID: 00014695-00003288)\n Spawned process \"attrib.exe\" with commandline \"attrib Default.rdp -s -h\" (UID: 00014700-00003260)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Sets terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Shows Globeimposter specific behavior"}],"sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":34,"dropped_files_count":0,"extracted_files_count":188,"files_written_count":79,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["globeimposter","ransomware"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"597f1c637ca3e12f3f434a53","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"ML.Attribute","submit_name":"98wugf56.exe","analysis_start_time":"2017-07-31T13:02:14+00:00","indicators_count":{"informative":10,"suspicious":18,"malicious":16},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}],"processes":[{"pid":2984,"ppid":0,"name":"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe","command_line":"","sha256":"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27","normalized_path":"C:\\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe","uid":"00013948-00002984","icon":"$26"},{"pid":2952,"ppid":2984,"name":"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe","command_line":"","sha256":"adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27","normalized_path":"C:\\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe","parent_uid":"00013948-00002984","uid":"00014538-00002952","icon":"$27"},{"pid":3072,"ppid":2952,"name":"cmd.exe","command_line":"cmd /c %TEMP%\\__t3BF4.tmp.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014538-00002952","uid":"00014627-00003072","icon":"$28"},{"pid":3192,"ppid":3072,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00014627-00003072","uid":"00014642-00003192","icon":"$29"},{"pid":3312,"ppid":3072,"name":"reg.exe","command_line":"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00014627-00003072","uid":"00014685-00003312","icon":"$2a"},{"pid":3236,"ppid":3072,"name":"reg.exe","command_line":"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00014627-00003072","uid":"00014693-00003236","icon":"$2b"},{"pid":3288,"ppid":3072,"name":"reg.exe","command_line":"\"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00014627-00003072","uid":"00014695-00003288","icon":"$2c"},{"pid":3260,"ppid":3072,"name":"attrib.exe","command_line":"attrib Default.rdp -s -h","sha256":"db24550c3183fc38f9440134322f124447dfe0a3564490180418305d7899d159","normalized_path":"%WINDIR%\\System32\\attrib.exe","parent_uid":"00014627-00003072","uid":"00014700-00003260","icon":"$2d"}],"all_imported_dlls":["lpk.dll","sechost.dll","atl.dll","vsstrace.dll","vssapi.dll","RpcRtRemote.dll","ws2_32.dll","ntdll.dll","usp10.dll","apphelp.dll","rpcrt4.dll","advapi32.dll","rsaenh.dll","cryptbase.dll","vss_ps.dll","ulib.dll","user32.dll","winbrand.dll","rpcss.dll","nsi.dll","uxtheme.dll","shell32.dll","imm32.dll","KernelBase.dll","dwmapi.dll","clbcatq.dll","kernel32.dll","gdi32.dll","msvcrt.dll","shlwapi.dll","msctf.dll","ole32.dll","oleaut32.dll","cryptsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"addons.json","sha256":"bbab152eed6aa6053669d477bbc64ce6265e22e2ce2ea10f8e171fbe81acb480","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"blocklist.xml","sha256":"f8c1ea9ef665559470bbb545ea105ba62343828a0893c06c5200e152e13d299c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"cert8.db","sha256":"65c8389ec614bf22674755e9adf5302a54c0b187f07beac9b09d71ac758ace98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"compatibility.ini","sha256":"02b16fdb92038912f36f527ca2dd55d89bbbc25c9fa1658999c4ff4bc656f256","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"content-prefs.sqlite","sha256":"650c33460fb9ec564a0012258bc82daa93a750e0ef356484e284e5743ef54254","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"extensions.ini","sha256":"9f2657a37637b5bd447281a8d481dcdd9fc61dfd4eafe7bc67338d9a1e562c7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"formhistory.sqlite","sha256":"1758e5a917e7d5db1e01ecd9cb8a1177178fd313c77ced87a005b83cc8c8b2ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"healthreport.sqlite","sha256":"ae2dd8d42799aeb3c1e044f8df600885af5c04793421138e7bc67a481491bb85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"mimeTypes.rdf","sha256":"97019ccade6eef7067b945f923775bfa7c46c6fee30693206c8715a5794d6e96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"818200132aebmoouht.sqlite","sha256":"746ff0093d78bc96304def24ed8860aac9337ba9856a679838615d6dc7dd494e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Google Chrome.lnk","sha256":"d1ebdc0081420209520c814d33a3958d67e874c02a28e71fe51e9f4f0f5991be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Mozilla Firefox.lnk","sha256":"1b068dd7f40ee4a87a3ea05f379293c2324d6d516341e88af3136fba80f0818d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Chrysanthemum.jpg","sha256":"a29f81e1329a8654cd05ae5690efe1723c7c9de882be1f6c2f9bf465c25e85d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Jellyfish.jpg","sha256":"3d74d20f4a78378462e15cab7b5c26166cee8ccdcf1a99a9f071caefd531de73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Koala.jpg","sha256":"844fcf47bbfdaf42e509e871319f562e6cd2ac6ebfbfcc036d4095257f7856e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Lighthouse.jpg","sha256":"7969c1f3b4eb8d3fc718531806e4fe1aa7bd2c7200266a0ab7acefeed76b8dc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"{e29ac6c0-7037-11de-816d-806e6f6e6963}","sha256":"513cd17894bb38dfa080eecdbd40d49511a1fdc47caf8f71d865f522f3a7a36b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"desktop.ini","sha256":"7441ea8a40e808fbbc4b349fd16809b0e7a6f103308fdd531e1cb43a5c98e783","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Calculator.lnk","sha256":"f0c517dd9138efe72d48658243e11208d41b269c4587cb29e6cc56dd71a0cad1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Paint.lnk","sha256":"f66109054aa9ec7ad48e7372d902182078781d3aaae82d01a084ddb5210a8b43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"8ff4d73b584fef899832ab7a234a236dfa4185ef4da88b481e2a7fed90bdf9f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"0zIG0D.doc","sha256":"2e282f332212b1a999c2dbee3f9ffd778962c00c97c62d2f31082b7bad02d941","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"7a64019bd3a04ef44931e201b3c3a2f0d5847e145c51c1ac0b7305989a541e13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"6SZfLTu9z.doc","sha256":"df706937ca0a26fffbf57f4acb86645b61fc62c794b2c4f86a7b6a6f53c4c740","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"e9b11cf932e065724040ebfe5e229fe248311ea029db2b77bfc0ac82cab59e22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"EKeaJO.doc","sha256":"f49788a6ca80fc9efdc10fadca7652ab42895e49786451ac652af0d12344339b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"F3hzum1.doc","sha256":"b1ee018495ceb8dac06d2e6c474d201e028720ca14e4cd55c034d5203b2b0906","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"dH1rDN9f9.doc","sha256":"dd9b90780c61599f613b39c09ff265ac34ec0d0e2f179afb8969528358ec8ac1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"dskCEJ.exe","sha256":"a13086049c812a5749b698b199ba8fe82a91b8a5d9e7ef11eac68a8cd7b3cd5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"hKY8.doc","sha256":"e6bc472a995a0ed39327aa7955d0082e1ec35d8b8641bb44b768e7901a7b6244","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"hlchPBL.exe","sha256":"e5c63cb2a026370710a9b4a35ea0f48ae169d726f06bba89997595e493acdc3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"kY01UeAiy5.exe","sha256":"9ad069827ff1d5bce697574028b4bda18fb8c9851b0627c9b5d8dff16053fc12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"1f22a98d37a1e2118bc8f9f86edd4dc00a15c14175ae16ac5689c5cc03c26a2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"mtgFs8Za.doc","sha256":"48766412519989987fa212634024eab9b1010268cbea3d38db2882b33b75492f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Desktop.lnk","sha256":"c0d4bc1939479e3ace1b300cde4979058dccbe82ddbf942b256fecae14f8f561","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"autoexec.bat","sha256":"1b76a990f1ea5162d5ef5b4dbf8636f974a516fc5f5ca2e33a4ded5bf9b3fb3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"BazisVirtualCDBus.inf","sha256":"93348054ecb4ce97ea9a3d914738d5aaa1558034322e30cc00850053aa550d3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"EXPTOOWS.DLL","sha256":"7d64efbd4d0cd34d3ca3b8d221192e49cbd00f290630c8183b8f98daa5e4414e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSOUC.EXE","sha256":"61837dc5e6e7fd0dd495fe38229bf30c845142981d8cb0eaaab987d8c2c26f4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSSP7ES.DLL","sha256":"fd285f76c5d740e7d19cc66f3f244c1cfcf344edfcd9ee6698e69c027100e29e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"c2.dll","sha256":"9e469042e7d923db37667928a518c40ea30789f4bacf8763894be1492a2e5871","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OUTLPH.DLL","sha256":"f7e4798a63a785ba0c3855f9b940d3d023e524214e10cf77fcac26953919e19d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"c1.dll","sha256":"f39b526b22e9358953b9697dccaaa2416c9da942a2123dac74b54b578b727e4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"liblzma-5.dll","sha256":"22b67e47df114c3a4e7b34816a7ef18d6d0be8c2b0f04e3bedeecceb2c7e21c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"dumpbin.exe","sha256":"84ae1f719df10e558277c76023c9d626ebc02c504a3bfdce00a46b684e5ac146","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"c1xx.dll","sha256":"6e0c62c8f9ecee4c9cf3802c8e3bb5c4e40d88535aba88338355352bb0248735","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libpangowin32-1.0-0.dll","sha256":"df67d8686a2e544c67ff3696922f333353ad86ae971d26b0704a9580e739fb8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"CSS7DATA000A.DLL","sha256":"193e8b92d445b9479021aaaaf3ff8a0e029ffacf07107dd8da41b50cd2151031","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libfontconfig-1.dll","sha256":"0ca74885ffdaebc94838273fe8cd801d01a7cd1336cfe78823d23414882ef797","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"jsse.jar","sha256":"2fe9f0425ad5510f8d193c772330989fc452a76f9343299e6e843bcdb26ffc9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libatk-1.0-0.dll","sha256":"b9348b9c08d592e3016ef5e06e2b3939b22491e0e92a5ad6700efe53de37b4c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MCPS.DLL","sha256":"9bc35a69d0b2a85e643d2f53558cd1179497a9da3362e5e14ce6066cc48a1099","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"GRLEX.DLL","sha256":"458a544940e1776315d1ecc74e776d3d9f53813a215bd02c79d7c96436a341e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ONBttnOL.dll","sha256":"2ad9b4418d78ecf6ecba71bbe2a5c3a54d54e4fde806e605196e1141f542fa25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libtiff-5.dll","sha256":"371434c46fa5eebfcce36e55b0bc1df3ee609f1b4c177dc5336aed0e76edbad4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"oisctrl.dll","sha256":"73fd0f106036001e4a115b165587f834706b36241b1f591838e636ae4e93e86a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"lib.exe","sha256":"c76e92a5c5847c291fcfd41a7b9b6871252ae712f6df8a60667a350b68de2c0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"cvtres.exe","sha256":"c08ea93e36457caf1842921afd0486f6015e63324edc42ae6a0623f9d15f9533","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSOSEC.DLL","sha256":"518ccc1a56104e9f4fb27995d70eed38203c9de2c99477c5a5ab48d1cedafb2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSHY7ES.DLL","sha256":"cfda19129aaba57d327505ffaf3db1921818f89b421acf2abc327056958d5c54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"jfxswt.jar","sha256":"6749086e37e3b12aab9c2a71aa39178af568947737f619c125033c49729b9986","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"IEAWSDC.DLL","sha256":"e9a730a48e1f2ee3307980b74bdef8cbfdfd095ab61f78ffc9f517fa5dc9f366","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libpangocairo-1.0-0.dll","sha256":"05d7f63acdc1b4a2c0ae29ced3b6f4a0e69d85f61d659f2cbaa6f48764fb2f44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"mscss7en.dll","sha256":"7e308036272c8a12e0222ca18349351f3944b1954193cf37ca93cc689e71e597","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MAPIR.DLL","sha256":"415bd4708450993240d286b25af958d62ee640593a9d5b9db7623541e69f0296","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ospintl.dll","sha256":"bfd75b254e5e0d672d28dcb1c6cd9e35c11abff39a8967ba537a82b8881c8f11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OFFRHD.DLL","sha256":"a5aef0567f01ac606f2c420e06cf223591e6718a7570b6999bef655a7a5b0e42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSQRY32.EXE","sha256":"7db89eeb2d0e112472dfee64751fe6c52f3bfd40f7cc4f1c00a71ab145f04e32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ONFILTER.DLL","sha256":"2f7cddd9123ac420ba675aa985d6d7f666a61e9832f3b9c301f2bbaca07dd84f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OTKLOADR.DLL","sha256":"01839fe92af83dc7c84d99827e06ac174ef1f73b29c8dac13e7047dc65476d62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"linkui.dll","sha256":"21052466e6c8a6b32c3e9267ada2376496c68082aba3e8b630450215827661a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libgio-2.0-0.dll","sha256":"5ff6c77fc6c30864eb7509528f2338d19ef0a114b9d583680516dbc746f2becc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OWSCLT.DLL","sha256":"6dd6aa602a7de470ed0e18f6ec4e2e6dd24aa3aa73f585450012ebb6154aa168","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OFFOWCI.DLL","sha256":"ed05a80c97d9e1f2a93853d3887654b1218c7adfe6b49eea6ffd4cc91ed2a7da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"chkrzm.exe","sha256":"2556a8581caf95a3a5df70bd2c5d27fc50a946ab2c851646ba4d74132c65206f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ONBttnIE.dll","sha256":"490002f6ca26949a44afb43ec81eef11facb49813e6390769cbdf88a1972981f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"EMSMDB32.DLL","sha256":"2f100c91a5304b400241957faee8c008538333fcd63406634256a44669f37a2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ONBttnWD.dll","sha256":"f913d38c8be40c24b31197499b51991e045372291dbea9c1d3047558143e9493","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libgthread-2.0-0.dll","sha256":"937e5b3bec78e8587e66177acef6b10b3f69431be51f5646d31971270855d149","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"mofl.dll","sha256":"65729d3cb4e25c244d8deeef6cf85d8cf535326bb8d68ab4b5937f244e00496b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ml.exe","sha256":"d8fa9512a57a73eb5082ee005c731781382ce4e7540da3b80a9e488ed3b501a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"GRINTL32.DLL","sha256":"4a136d5f58b8a40bfdbff5e48261dee9761327925a07372ab2786630d9ba8606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"NL7Lexicons0011.DLL","sha256":"7c682b5af91f798f40019bdf6aeabc3436b1dddd618145b5dfff1dc93e8299d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"AUDIOSEARCHSAPIFE.DLL","sha256":"028a83af9433e6c677c7b17b10b2ca0e8132cc9bbd48e4ec7b547965c776ff9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSOHEV.DLL","sha256":"dfd1fc1dc55de6210a520487fbe7da39dd83bc95db0f3ca0d702df2f56454da9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"mscss7es.dll","sha256":"c99dace8e414155d6d5212e856f39713b9fb90a894f9af15d7fc520ee4f113ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"AcroRead.msi","sha256":"aba0db447b932bd47dc2601433c971ab6c656a4b43c703d98dc7e68c33f5cea3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSOCF.DLL","sha256":"ec834c4e05ace104c20b82b3127cd740e141b767e09e38f0c1058a6c1fb5b49c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"msvcr90d.dll","sha256":"f85969d8d12d9ef19f6dc9feb21ae99ad26e6f0c3f286bf02ec3b01210c6ab12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"FreeCell.exe","sha256":"12ffd0ef510136f78906b3669c2c364fc3b3fb20dbf4d8defedabde73d26d0cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libpixman-1-0.dll","sha256":"79360f18cc59a4ddd574938c085dcf8723cd140f9683b26f70cc71700afda1e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"link.exe","sha256":"9a051c6c9d7a63614a0fbc5b3d60f7ebd31f06ae8451cf65e066f4df9867f8a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSOSTYLE.DLL","sha256":"b3979d01244540a6996c3cf383c036c1e137b0e685058e67e8a34e4822a1b7b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"AUDIOSEARCHLTS.DLL","sha256":"a5b44f81842d7afbf7be9d9c2bc90c7dc98a878ae6b973a40845025052c96054","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"maintenanceservice.exe","sha256":"4883d0af8f0b623161424e1f35c5f36cb4f8fdc6d3791db9a518db977c5c2d47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"javaws.exe","sha256":"4790fcff712131b9ea0a52ece05bb8a276fbbf7be550df976998297742ee6eb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"FORM.DLL","sha256":"cdd0c3eaa66bd7f0b7aa653e4044cc1eb4d9e32ed70f3b8bebca848db558936a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSOHTMED.EXE","sha256":"4706279b665f2797b080546cf075c175386cdaf07f22d883444c9f061987b640","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSTH7FR.DLL","sha256":"bc338ae86ff9a45ee462ee088224aa2ee68429c6461cdf7180ff3b73c6bfe70c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ONELEV.EXE","sha256":"36d7856b027fd85fb46dd9dd97a6309d1e416352e134600cb843631f4ef2c58d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ContactPicker.dll","sha256":"f14a12b24ed1fe0b5b02052f3259d5c2f17ff261d1f578a1ed9b30c35c6c9335","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libharfbuzz-0.dll","sha256":"63ae2b90a7ea10cf54b04ebd9ec9daea0f9b07e0186b89ef212a7909a8cdbaef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSHY7FR.DLL","sha256":"d72a8799f0066824c0f023a030a4dafeed9537aa3630288f1f9a31717502ede7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"charsets.jar","sha256":"7fbfd5fad152442d337c6b6a6789f927344f7621bcd7e1dd5a1fca9c4bede495","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"javaw.exe","sha256":"341ceedc3e97f784450cc18f13b0798d5a0afbf14f8924a205b42900ee583733","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OneNoteSyncPC.dll","sha256":"76a8c0e3b998d3d84d014c6e06f5ae6ea4fa9fbb33b816121c74c8fc7c6d1309","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OUTLBAR.INF","sha256":"b8cd2910b6407dc85a3f11415544c308072feb1425a2b4d08fc4c51e2bd433cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSGR3ES.DLL","sha256":"76f000aeeb3a79d254ca834470121add46bec25be0fb7e899d82c98a8cc969a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OEMPRINT.CAT","sha256":"557399e5d06b8e4ad26cc326ed0c05663c3d19fc185aa20d4df086fef0eabd9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libjasper-1.dll","sha256":"11f5fd324d19ee1052aa7a54b0097ed92458f7f05e2a24d0c8e027700fba95e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"NAMECONTROLPROXY.DLL","sha256":"4d897198e86212c2188dd1da69c022b28246a423075d7e19580b6913202ca47b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libfreetype-6.dll","sha256":"21c56b5f68a97888d6be8e6ba0691ee88f6545f22f439416f3f103d7f796d14c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ONENOTE.EXE","sha256":"34d0e6be1d20dae4ab34d5d9b2bb3060f9786344da9a6dd695b693dd6e9499c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libjpeg-8.dll","sha256":"1063adfdf8dc45fa902f493273e95b530258b65e1003d65f13bb962b0b46388c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libpango-1.0-0.dll","sha256":"c15f420b52f9035a577ce07bfdc37e175d201877b54ce9fbeb07beac91199acd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"mspdb80.dll","sha256":"2053b4088767140af334c85bafbcfac892b4b4b50b4f2d82e9a673287bc372e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"nmake.exe","sha256":"c1c5e7884abcebcc7657d473ed8469cdf96a0883db8563a1832311f95fdc97e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"NPAUTHZ.DLL","sha256":"e9ef749eece6c4806309c5280280a4275d0243cb94e7dea0ea2a8d3671238050","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MineSweeper.dll","sha256":"167e7d4acd4d501aaa7d3d34a4f6548e699620a7365e5030ac8a7fde470cf31e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"mspft80.dll","sha256":"9df8fdc100c8260787e86e1fe50189e9d63e7abfb938b0be4ecf430fc661aeac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"bazisvirtualcdbus.cat","sha256":"0409959b355cfccf2911a22a2055a50a74efddba87b11434e2562d5d85409241","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"mset7tk.dll","sha256":"956c947a28168bffe86398eeb0ffd9e4db88eceabdf70b6486e9cfccc403cc0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSTORDB.EXE","sha256":"c7acbc03b04f344ed2307b5ba00c5100da22d2700dc026e21cb547bd4601ad03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"GKExcel.dll","sha256":"77461d308d5d773d0c808911618828ecded339327d90b2e998cf7dd14a4d2f9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OneNoteSyncPCIntl.dll","sha256":"0414e23f4162021aad2b7e04078b94344729328ce07e530865bf6658ed6c5913","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"CDLMSO.DLL","sha256":"fbe269db32646102db62bb0fa72e73fe6a50cd86e15edc955fbc353351ab5bc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OFFXML.DLL","sha256":"d5fe68df29c98bae1b7f9cd53a48ddb4d1244ec8b1bc29a03032905ed8552202","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSOCFUIUTILITIESDLL.DLL","sha256":"eea56c2835e16ad50d3e87a3392fa246c9fa51c664207cc50c779f9af4217243","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"IMPMAIL.DLL","sha256":"a808f76019a6e43fab2686c69db2d9e5e6b014bf7de6c21e7b23351d61ca01cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSOCFU.DLL","sha256":"1ad2854bf47c6e63742f439eca08a367953eee60f663d16785e94bd8a4ed0f67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"BULLETS.DLL","sha256":"e195c5bd4cef7f2c1306d80fcad486c3ad26ce880df10d7f5a11b8bd6ff89d90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"CERTINTL.DLL","sha256":"4482201ec36a2578127d7f7fa7fece22a3514cde8cec865df8f3c8910a790cc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSGR3EN.DLL","sha256":"ddc4e0f44e253a23ac7239daf1e6cf51ea4a0dbecc2429d58c3f02d80f749215","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"mspdbcore.dll","sha256":"8fe76073036f386a1bb04f51631a7c4dfcabc16a033941e58dcf523fbbec2686","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"bckg.dll","sha256":"80cd4b2663e4b448f3ad39099123ba2046063dce4abaee2b23a81597070a3b33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ONENOTEM.EXE","sha256":"631c2b60bbc3af10fd30849da08b19819f532e191e00ab2e594413eb05e36135","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OCLTINT.DLL","sha256":"7ae305a8eb651a8a34ee101b0f2ef7f7c5fc5a6bad9f2fff1b075a2a62a6f806","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Chkr.dll","sha256":"b32d3514e28f0e9da0af1e3f2f4e5ee2915869224a6e9556612da0f0929be3fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"CONTAB32.DLL","sha256":"b74de08fbe3c6ccd9ae751d6a4290c1a3b93238cf8683301fd626e762d1532e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSSP7FR.DLL","sha256":"26ac256895a4f0fce62dc727da88c76481e428d32e443aa135c7e3cb3841ce1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MAPISHELL.DLL","sha256":"bb229789e50679a9963a7d86acf10793e0e6411b31ead1b4cf088b05f5584373","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSOHEVI.DLL","sha256":"5d82bf34ade629ad14edd7ffbee1e4d15ae80d5e142fbfe11c48b60199f01e03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSODCW.DLL","sha256":"3d042dc24128c35cdb39d87d3b8c44ee18bd7c3574b691719cdbcd87b2c4cee7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"libwimp.dll","sha256":"8360c98940746d96622cd81835602e0fde99ddc3f53b9ee30d289c9b7bba4e9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"IPEDINTL.DLL","sha256":"c1a837815e475ae0ac813c02097fc7504b9978fa04cbdf55d00070089b45c842","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSCOL11.INF","sha256":"226981db95e53b9df8ecb27f51a1751b3ad183f14688ed245c96301199634c21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"mscss7fr.dll","sha256":"f1561d6a82ca4135e998d430e3464bc3e75effd8b78ed6a8ac91ec9f13fdfdf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"FreeCellMCE.lnk","sha256":"0f54d9ee35b936083123cc371ce995dd618f643f71da4322e792ad23a93f0544","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MSHY7EN.DLL","sha256":"6820ad6da274a330d757d97eb28c78e8e069dcec2d60e27bea96bec010f32288","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ContactPickerIntl.dll","sha256":"6c8f92d6c5eda9f6987513d8a19a4a7a3c8e6bde83e054f179199c50a6113944","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OISINTL.DLL","sha256":"73b5b30fe27f4660cc99468e516d0ed6fd1237af97050fe1228a803353cf701b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ENVELOPR.DLL","sha256":"91ecaf9881e9aca87e7e2ad456137a6ad66234dc276fde0ead3c52a2e9942cc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"EAWFINTL.DLL","sha256":"351d54a45ea0e50f3000b4156b6e273a1311dcf22df7412ea81ccf61f762d149","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ApothecaryMergeLetter.dotx","sha256":"12097180633e3f26870159bbbc36a0072df277a0e395920cd183bd24810227ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"AdjacencyLetter.dotx","sha256":"4da8d66157abd83c2fb1da4ef35d3c57a13a239e1b1e0f1f36f13eb79f7872d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ExecutiveNewsletter.dotx","sha256":"d27acbad57b401863eb8f31ff13522c4975e33e621081967b4856420ed2f42ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ExecutiveLetter.dotx","sha256":"0a82e7ccc9b8c04eacaca6621b52816118dc1b18bae7dea41b7d9b6cd4defcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"FUNCRES.XLAM","sha256":"87a1e735db3b0251c13def19133b77aa56180bd99a4d7551fe9866f67bf3c9b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"AdjacencyMergeLetter.dotx","sha256":"2e3c91c40183f6ef6716d447ae3d783a6736561fd726fa77caea100cf240f268","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ExecutiveResume.dotx","sha256":"9d7c867554bd93b0a109fde4ed11250f28882fe007a0989cc9fac4721a370461","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Fancy.dotx","sha256":"08fe4adbd6eb0536a1c9b89f2fc407ca6754606dcd42dd1794a041666483f4aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"BloodPressureTracker.xltx","sha256":"0e33ae2dd0f9d0b99215b5adaed8bffce9be36bad8fe19ee4733b12c3cba696d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ContemporaryPhotoAlbum.potx","sha256":"67642e74468152a50c2d64f7c832f09f3b5bcb549fc8a4188ac69e8edc8e269f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OriginMergeLetter.Dotx","sha256":"1826b11ba0e0454c243be7795056be8cdf2edf5e968bc82fdcca15434dea1221","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MedianMergeFax.Dotx","sha256":"ed0a6bf37524bc92cb8b5095250ecec79c1bc459b30fec2ef1c97073937be9a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OrielReport.Dotx","sha256":"efd2d59be423bff2451749d4b8dc71c660bc3af08fc015cfee2a391badcc8b28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ApothecaryNewsletter.dotx","sha256":"199cfc80e59cbe5a3dbe1988e8f7dfd9e9fc04d3e03fd88b40f62b242109ed24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ExpenseReport.xltx","sha256":"4cfd2a46c92fc2f58bb7906165063935180d66bd98ff8a2f3e201bea5b76d110","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ExecutiveMergeLetter.dotx","sha256":"d84db072042b9ae212e36c4ac21427fa080a5484b3d9f02cc84e205e689f297e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"EquityReport.Dotx","sha256":"8373bb28816e462cde06cb8fe0ad8e9fd9d1fce9a62ffde8bdced6d1e1e7f1c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"EssentialResume.dotx","sha256":"ea725dc4801d0281782655cb472a20139d133272e2d237cd311d42bfd7debf65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OrielResume.Dotx","sha256":"f0a315f79eee3ef2e11bfb1d17ea62655041eb6c15bc166540ed3ba6064d3f52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"EquityLetter.Dotx","sha256":"2c67ab8697ca7cfb8f01cfb1ce14dae6bbedf9b0b8f5fb16ccf2c33f8f85d188","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"EquityResume.Dotx","sha256":"d0625c56d486efa2f79448ac17189eebd42ae9b59e9af600291038dcfc4dfda4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ATPVBAEN.XLAM","sha256":"bdf962728a464f52efd16784911e54ca4127431ac1160b2978e23e96aa14a724","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MedianReport.Dotx","sha256":"b10c1eafcf925aeabc676415bdb3281d8737cb615a7741de7b5672d71cb51924","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"ApothecaryLetter.dotx","sha256":"0a848e99e04806165cb3cfb7beb6a4a078d5b23203303561d329763d78fd5cb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"AdjacencyResume.dotx","sha256":"90454ee3dd544bca341ed1312afb520123965db2bb4fba6bcb3aebe03dbb95e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OriginFax.Dotx","sha256":"be646638f051445d5ca44deac101ed9bca51c4b749a3d82679f70702a3f4be4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"EssentialMergeLetter.dotx","sha256":"31d4cc68af3848d933dfacc2381b6c06c8a3f670892931099f16c8ae0c9a1171","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OriginLetter.Dotx","sha256":"d2a8e4ef7db5b15cc0d764905b6a7125a76011b90967bb231eacf86917f769e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MedianResume.Dotx","sha256":"309390a4d705500017c17e1703686a40519221098dbddf77c38af2484b0fad54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OrielMergeLetter.Dotx","sha256":"4ef5c550506efdf5e29037bcffe4b1136ac7f48c18e354d3ddc67042d93c7cfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"MedianMergeLetter.Dotx","sha256":"884d6854cf9357ca31849ca6de612c1cc4ba9acdaff769ad52a0269e7313ab8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"OriginMergeFax.Dotx","sha256":"7f4962f39ede0dbe67c767bc28f8f7e965fb976fbce11bd676e1bf3d2d313a81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"EquityMergeFax.Dotx","sha256":"41d6af2ec8a2d6b16cfdcab201956528c494feb1663b5b0323e1000d23b5a4a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Classic.dotx","sha256":"78719a39380726fe884afd9027bcc8bb12402e1c3280f6d529d02b3ebb0cdccc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"name":"Formal.dotx","sha256":"2e0127c6848f3d8ee1e279dd999416c5b7d78f61b8c0344886e88f11609473cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]}],"files_written":[{"path":"C:\\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"%PUBLIC%\\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"C:\\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"%PUBLIC%\\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"%PUBLIC%\\adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"%TEMP%\\__t3BF4.tmp","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"%PUBLIC%\\{e29ac6c0-7037-11de-816d-806e6f6e6963}","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"C:\\1501502554566$OK","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"C:\\6Id.Vqu","sources":[{"report_type":"sandbox","report_id":"597f1c637ca3e12f3f434a53"}]},{"path":"C:\\<<