oceannew_vb@protonmail.com

24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample b269b77b38e3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b269b77b38e3…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef"],"about":{"@type":"SoftwareApplication","name":"support.phpf1.dat","applicationCategory":["peexe","executable"],"identifier":"b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4b3,Pattern match: "http://tl.symcb.com/tl.crl0" Pattern match: "https://www.thawte.com/cps0/" Pattern match: "https://www.thawte.com/repository0W" Pattern match: "http://tl.symcd.com0&" Pattern match: "http://tl.symcb.com/tl.crt0" Pattern match: "http://t2.symcb.com0" Pattern match: "http://t1.symcb.com/ThawtePCA.crl0" Pattern match: "http://www.usertrust.com1" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "gijICk6.Uj//fG]K/bI'Rxd.vTv#KI]X5.Dl8lS+qPsslzT#;LwI|/UM#1o$bq}hF0mcefi~agSH$eRePYVuH2H+V5B" Pattern match: "R7.hS/_stCB4UMq465z\q@lfpEPNv?99.YJ8yBU/g1CeinMh3/oQ@QncPH5" Pattern match: "Ep4.vCne/&,AbSunAwLF4" Pattern match: "T9.pLBj/gwD&Q'uo\E" Pattern match: "b21ovh.if/H^$?UsO" Heuristic match: "bvM]>Bu>h~>GboTe oceannew_vb@protonmail.com

All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail oceannew_vb@protonmail.com in body of your message write your ID

You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.

Free decryption as guarantee

Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases, backups, large excel sheets, etc.)

How to obtain Bitcoins

https://localbitcoins.com/buy_bitcoins

http://www.coindesk.com/information/how-can-i-buy-bitcoins/

Attention!

Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Your personal ID

6B 08 FF FE 86 03 8F 59 59 7C 56 D9 F8 D4 98 4B
17 0B 68 07 AD E3 43 96 89 D5 26 17 0D 4F 57 EA
A6 0A C1 14 A0 F6 15 1D 81 FB 19 7C 56 30 C5 FF
1A 87 CC A3 C6 A2 B6 9D F4 FC B6 5D 72 48 2A 8A
BF EC AC 7D 0C A5 93 C7 76 CB B8 4C F5 5B 79 B1
90 A8 A8 DF E9 99 CE C9 59 CC 9C 61 EF 17 2E FB
09 8B 7D AD DD 92 F7 F9 CF A4 79 0A 45 06 94 50
F9 C2 F1 BD C1 6C 00 78 3C 7D BC C2 C8 E2 15 B8
3B A9 03 06 97 58 FD 59 12 F2 EA E9 D6 B0 1C CB
E3 F0 A6 23 5D 49 7A 55 27 A5 A7 D9 C1 2C 66 8D
92 6E EC 48 A3 D9 F7 E3 70 94 DF FA E8 73 9D 1B
3B 7A E7 0E 3D B9 BD 4C 1A 7F 02 00 72 96 25 2B
78 D9 CC 78 0F 8E E6 E3 1A C7 8E 8E 99 24 6E 64
5E E2 02 16 97 1A 89 64 7E 46 66 34 31 24 B3 F8
E1 0B 27 C0 2A 89 BC 3C 50 E7 58 E7 A8 C2 E3 EF
03 E5 64 15 AC 8F BE 60 EA 27 EB 6C C8 DE 82 7E

... !!! !!! -->

" (Source: !back_files!.html, Indicator: "files have been encrypted") "

All your files have been encrypted!

" (Source: !back_files!.html, Indicator: "files have been encrypted") "

All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail oceannew_vb@protonmail.com in body of your message write your ID

" (Source: !back_files!.html, Indicator: "files have been encrypted")27:T6a5,"" opened "C:\autoexec.bat" with delete access "" opened "C:\config.sys" with delete access "" opened "C:\Users\desktop.ini" with delete access "" opened "%PUBLIC%\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\Sample Videos\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\Sample Videos\Wildlife.wmv" with delete access "" opened "%PUBLIC%\Recorded TV\desktop.ini" with delete access "" opened "%PUBLIC%\Recorded TV\Sample Media\desktop.ini" with delete access "" opened "%PUBLIC%\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "" opened "%PUBLIC%\Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Desert.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Koala.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Penguins.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Tulips.jpg" with delete access28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790441975432,"unified_at":"2026-09-26T16:59:35.432Z","metadata":{"hashes":{"sha256":"b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef","sha1":"9bcc5e2030b2595f2843e637c0bc2ad7583c7a6a","md5":"bc2c23ba44364ba04736b19a4482c8c7","sha512":"7834ad89fbe7bdf7150724a87760342ea33094899f90d34777ec8bdf2fd3deffd70d5d28ce5401086bdf9da9fcba94d19889d25386330d587a950374daebcbfb","ssdeep":"6144:6LXWWWWWWMWWWWWW0ZadRwMTmkxZF4zExIdkSC:6rWWWWWWMWWWWWW02w4JxZNx8kSC","ssdeep_chunks":["6144:6LXWWWW","6144:LXWWWWW","6144:XWWWWWW","6144:WWWWWWM","6144:WWWWWMW","6144:WWWWMWW","6144:WWWMWWW","6144:WWMWWWW","6144:WMWWWWW","6144:MWWWWWW","6144:WWWWWW0","6144:WWWWW0Z","6144:WWWW0Za","6144:WWW0Zad","6144:WW0ZadR","6144:W0ZadRw","6144:0ZadRwM","6144:ZadRwMT","6144:adRwMTm","6144:dRwMTmk","6144:RwMTmkx","6144:wMTmkxZ","6144:MTmkxZF","6144:TmkxZF4","6144:mkxZF4z","6144:kxZF4zE","6144:xZF4zEx","6144:ZF4zExI","6144:F4zExId","6144:4zExIdk","6144:zExIdkS","6144:ExIdkSC","12288:6LXWWWW","12288:LXWWWWW","12288:XWWWWWW","12288:WWWWWWM","12288:WWWWWMW","12288:WWWWMWW","12288:WWWMWWW","12288:WWMWWWW","12288:WMWWWWW","12288:MWWWWWW","12288:WWWWWW0","12288:WWWWW0Z","12288:WWWW0Za","12288:WWW0Zad","12288:WW0ZadR","12288:W0ZadRw","12288:0ZadRwM","12288:ZadRwMT","12288:adRwMTm","12288:dRwMTmk","12288:RwMTmkx","12288:wMTmkxZ","12288:MTmkxZF","12288:TmkxZF4","12288:mkxZF4z","12288:kxZF4zE","12288:xZF4zEx","12288:ZF4zExI","12288:F4zExId","12288:4zExIdk","12288:zExIdkS","12288:ExIdkSC","6144:6rWWWWW","6144:rWWWWWW","6144:WWWWW02","6144:WWWW02w","6144:WWW02w4","6144:WW02w4J","6144:W02w4Jx","6144:02w4JxZ","6144:2w4JxZN","6144:w4JxZNx","6144:4JxZNx8","6144:JxZNx8k","6144:xZNx8kS","6144:ZNx8kSC"],"imphash":"4fe334eea5967bfbfaa0876dc7b03620"},"file_info":{"file_name":"support.phpf1.dat","file_type":["peexe","executable"],"file_type_id":"exe","file_size":263248,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1501537043000,"last_seen":1677893202000,"last_multi_scan":1677893202000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["globeimposter","ransomware"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":17,"malicious_count":9,"total":38},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.tq1G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Lukitus3.Exp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1233238","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.GlobeImposter.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Locky-6335674-3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.TrojanDownloader.Upatre.AB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.GlobeImposter (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.FV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005162cb1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Agent.abdu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXCD-AI!BC2C23BA4436","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Upatre.ernrjm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Elenoocka-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.GlobeImposter.263248","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.4416324F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.4416324F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Gozi.FC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanPSW.Papras","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.882084","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00038524-00002760-56341-16-004045BF\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00038524-00002760-56341-294-0040458E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00038524-00002760-56341-243-00403E80","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-138-00412205\n GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-134-004128DF\n GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-141-004115B1\n GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-137-00412143\n GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-55-00412A5C\n GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-160-00412F74\n GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-158-00412FB1\n GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-161-00412695\n GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-159-00412F43\n GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-242-00401E22\n GetProcessHeap@KERNEL32.DLL at 00038524-00002760-56341-165-004120DC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\__t6D5F.tmp.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c %TEMP%\\__t6D5F.tmp.bat\" on 2017-7-31.14:24:09.593","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\__t6D5F.tmp.bat\" (UID: 00042065-00002820)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00042097-00002968)\n Spawned process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"\" (UID: 00042214-00002384)\n Spawned process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"\" (UID: 00042233-00002864)\n Spawned process \"reg.exe\" with commandline \"\"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"\"\" (UID: 00042244-00002552)\n Spawned process \"attrib.exe\" with commandline \"attrib Default.rdp -s -h\" (UID: 00042257-00002344)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=thawte SHA256 Code Signing CA, O=\"thawte\n Inc.\", C=US\" (SHA1: 08:15:93:99:87:9E:46:D4:64:ED:09:0E:C1:05:9C:7C:30:21:9A:3A; see report for more information)\n The input sample is signed with a certificate issued by \"CN=thawte Primary Root CA, OU=\"c 2006 thawte\n Inc. - For authorized use only\", OU=Certification Services Division, O=\"thawte\n Inc.\", C=US\" (SHA1: D0:0C:FD:BF:46:C9:8A:83:8B:C1:0D:C4:E0:97:AE:01:52:C4:61:BC; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"9rNtWnjTq9RGbU.exe\" has type \"data\"\n \"Adobe Reader XI.lnk\" has type \"data\"\n \"yZw6snqBQ28DAzu.exe\" has type \"data\"\n \"Qt5Gui.dll\" has type \"data\"\n \"liblzma-5.dll\" has type \"data\"\n \"MineSweeper.lnk\" has type \"data\"\n \"capinfos.exe\" has type \"data\"\n \"uninstall.exe\" has type \"data\"\n \"libpangowin32-1.0-0.dll\" has type \"data\"\n \"rRgk91Ih5n.doc\" has type \"data\"\n \"libfontconfig-1.dll\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"libxml2-2.dll\" has type \"data\"\n \"libatk-1.0-0.dll\" has type \"data\"\n \"WinSparkle.dll\" has type \"data\"\n \"UserCache.bin\" has type \"data\"\n \"libtiff-5.dll\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"libpng15-15.dll\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data\n .rsrc with unusual entropies 7.67833766413\n 7.33130084607","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00038524-00002760-56341-165-004120DC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Recorded TV\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Recorded TV\\Sample Media\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Handle: )\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: )","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"CERTIFICATESCHECK\"; Value: \"%PUBLIC%\\b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$26","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"Found dropped filename \"dictionary.alcatel-lucent.aaa\" which has been seen in the context of ransomware (Indicator: .aaa)","origin":"Binary File","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1387 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Remote Access Related","name":"Changes the attributes of the Desktop.rdp configuration file","description":"Process \"attrib.exe\" with commandline \"attrib Default.rdp -s -h\" (UID: 00042257-00002344)","origin":"Monitored Target","relevance":10,"id":"target-83","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00038524-00002760-56341-166-0040C1D4","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegOpenKeyA\n RegEnumKeyW\n LoadLibraryExW\n LoadLibraryA\n GetFileAttributesW\n GetStartupInfoW\n FindFirstFileW\n GetProcAddress","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"reg.exe\" wrote bytes \"4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000\" to virtual address \"0x75AE1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"attrib.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%PUBLIC%\\b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/64 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/64 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"malicious","category":"General","name":"Tries to delete registry keys using reg.exe","description":"Process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"\" (UID: 00042214-00002384)\n Process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"\" (UID: 00042233-00002864)","origin":"Monitored Target","relevance":5,"id":"target-24","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00042097-00002968)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Shows Globeimposter specific behavior","description":"The file shows various behavior artifacts extremely typical for the Globeimposter ransomware","origin":"Indicator Combinations","relevance":10,"id":"summary-19","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"malicious","category":"Remote Access Related","name":"Sets terminal service related keys (often RDP related)","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\TERMINAL SERVER CLIENT\\SERVERS\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\TERMINAL SERVER CLIENT\\SERVERS\"; Key: \"(DEFAULT)\"; Value: \"0000\")","origin":"Registry Access","relevance":3,"id":"registry-60","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00038524-00002760)\n Spawned process \"cmd.exe\" with commandline \"cmd /c %TEMP%\\__t6D5F.tmp.bat\" (UID: 00042065-00002820)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00042097-00002968)\n Spawned process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"\" (UID: 00042214-00002384)\n Spawned process \"reg.exe\" with commandline \"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"\" (UID: 00042233-00002864)\n Spawned process \"reg.exe\" with commandline \"\"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"\"\" (UID: 00042244-00002552)\n Spawned process \"attrib.exe\" with commandline \"attrib Default.rdp -s -h\" (UID: 00042257-00002344)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Sets terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Ransomware","details_count":3,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Detected indicator that file is ransomware"},{"detail":"Shows Globeimposter specific behavior"}],"sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":38,"dropped_files_count":0,"extracted_files_count":108,"files_written_count":80,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["globeimposter","ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"597f9f407ca3e11c284ac153","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","submit_name":"support.phpf1.dat","analysis_start_time":"2017-07-31T23:21:31+00:00","indicators_count":{"informative":12,"suspicious":21,"malicious":12},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}],"processes":[{"pid":2760,"ppid":0,"name":"b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef.exe","command_line":"","sha256":"b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef","normalized_path":"C:\\b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef.exe","uid":"00038524-00002760","icon":"$28"},{"pid":2820,"ppid":2760,"name":"cmd.exe","command_line":"cmd /c %TEMP%\\__t6D5F.tmp.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00038524-00002760","uid":"00042065-00002820","icon":"$29"},{"pid":2968,"ppid":2820,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00042065-00002820","uid":"00042097-00002968","icon":"$2a"},{"pid":2384,"ppid":2820,"name":"reg.exe","command_line":"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00042065-00002820","uid":"00042214-00002384","icon":"$2b"},{"pid":2864,"ppid":2820,"name":"reg.exe","command_line":"\"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00042065-00002820","uid":"00042233-00002864","icon":"$2c"},{"pid":2552,"ppid":2820,"name":"reg.exe","command_line":"\"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00042065-00002820","uid":"00042244-00002552","icon":"$2d"},{"pid":2344,"ppid":2820,"name":"attrib.exe","command_line":"attrib Default.rdp -s -h","sha256":"db24550c3183fc38f9440134322f124447dfe0a3564490180418305d7899d159","normalized_path":"%WINDIR%\\System32\\attrib.exe","parent_uid":"00042065-00002820","uid":"00042257-00002344","icon":"$2e"}],"all_imported_dlls":["msvcrt.dll","atl.dll","sechost.dll","msctf.dll","ulib.dll","advapi32.dll","mscms.dll","userenv.dll","clbcatq.dll","lpk.dll","ntdll.dll","kernel32.dll","dbnmpntw.dll","shlwapi.dll","winbrand.dll","RpcRtRemote.dll","oleaut32.dll","apphelp.dll","vss_ps.dll","ole32.dll","comsvcs.dll","usp10.dll","imm32.dll","rsaenh.dll","cryptsp.dll","user32.dll","crypt32.dll","msasn1.dll","gdi32.dll","cryptbase.dll","profapi.dll","vssapi.dll","KernelBase.dll","rpcrt4.dll","shimeng.dll","vsstrace.dll","ws2_32.dll","nsi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"!back_files!.html","sha256":"0163611e5fc4d7906c9824ee8a469931e264b5d076fcd6f29ea1ecfea0d974aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"__t6D5F.tmp.bat","sha256":"1a6f73b5c28d1c10f63f2056068c1de61487b8cf8f1dcf7516548df144b3e9ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"InstallTime20150122214805","sha256":"5bf11d984fb8a8ffb215dccbdfd2ec79f721d2b65132682d046c51a19ea0c1a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"SiteSecurityServiceState.txt","sha256":"26a6ffadd1f2f5144f3593ddeb6a589f7577709d8f65202aa1123a405421c995","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Telemetry.FailedProfileLocks.txt","sha256":"2019e05127b200620cc136a26890334504504c58f116965ba8af9098446207f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"addons.json","sha256":"017f7c0adeeed7b4232f166ac5ae4805f76390c53cee7ff8213d705b10db193d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"blocklist.xml","sha256":"dee3cdb1e0a1d4c3a5f7fb1f12d25f205c98f30fb7856466f6ede432517167c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"cert8.db","sha256":"e93da54629591e5ff03c8162b1b476282fcb7af7e98bb8efd76c69d00cf20524","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"compatibility.ini","sha256":"dcfb8cbc2e07643ac7b207d43429dafa080dd1d7eff13b5870df0b25f5f11421","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"content-prefs.sqlite","sha256":"a59362f684481f994d85145cd65adfc8060bec3aae2977ed366c19ad7befedcc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"cookies.sqlite","sha256":"19af4717e4dbece4eff275df77cb862c0a588045f4496e47f425deb9b85f4761","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"store.json.mozlz4","sha256":"08f58590d87d8cebaac73cb13bc1a3f65009625a871b03d5f14b21c34c26f9a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"state.json","sha256":"1e3bce1114aae0c631e87bc961c2e2d9b447d2469d53caecc784452b06a7b00c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"extensions.ini","sha256":"8cf504d492e896eb52eaa6d62fcfcc664edfb666986e8a12c722da97b42c0543","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"extensions.json","sha256":"47f39c644b9145f07ad70845457a70cc6a4df858f67c65bf491bed16950e8a5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"formhistory.sqlite","sha256":"1b6399514b8d263b576d37a7e9707f1c8a45af9792034ef4f9f203dc623d43a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"gmpopenh264.info","sha256":"b479910001f0c16e87d9978fb1d16ab4836c805665a95c6c846ad1bab56638f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"healthreport.sqlite","sha256":"241805e68039a9e157e5a17ef035715243f7e0f8633a878ac32f0a376f7c2a6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"key3.db","sha256":"457a9baa989a53cd12f5590e881948d521851811bfa3b3fffa01ece93bff46c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"mimeTypes.rdf","sha256":"ddeec6fb331cd3cab24d7863d90957ce3850d6398f494cd170d51d6927f88319","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"permissions.sqlite","sha256":"4696f8d94105d7347cbfdf7595e1e20b17987ea6117c451d1513c46b19591fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Adobe Reader XI.lnk","sha256":"be2c430eb2b5681f9a30664640b6306d94b0243a1f4912de44ea55d54b84abe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Google Chrome.lnk","sha256":"c19ede18bb9397748595d375fe6750ac799ee6a97c7192153871e51153d7131d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Mozilla Firefox.lnk","sha256":"235070dfc19c10a614f1a32444e1b45ccd7479ca9e25c223661aae90f8e1b5d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Calculator.lnk","sha256":"58e34f9b1453c0becd94b718aa9ab12ddc14b200b853e0f21ae7a7eb7bae9611","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"MineSweeper.lnk","sha256":"bf4d69832dbacc97e0ceaf4d00529ae7436e2d0557cc7c18e5c5ccb6d3072a87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Paint.lnk","sha256":"c2986cbf07a1533f9ebaca7578e1dfb41c7818a11c51b7c298c4ad19472e3062","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Sticky Notes.lnk","sha256":"e0ce5d0d43b7635092efdc510d1a1dd8f27e696a37f21382909973a33c0e05ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Windows Media Player.lnk","sha256":"c58a6c93e0cbd2d336edcc2d12ad0cfffcdc0b15ff84c46a5af3ea163c66a03c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"19e8764c1124351d1eaae20db76f07d1550e81b10f999150a8faf81659eb2b31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"1183f9398d70ce35722a39f794eae76d18a0a9759a30867b1ab0a6003f92dcc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"0zIG0D.doc","sha256":"8324200678297cc13c1385f145df71b06ce1aafd232c62b95b19826b6381c004","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"3d101b5425dde2a7a875d0ba9152260948d10a3a12d693371d4d8a4f70e0e971","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"ee4b7f2ccc84566baa9428d3dcf6ffbc501470382d56064a5cbcb4b9297ac874","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"6SZfLTu9z.doc","sha256":"087271bdd2f389e0687a95f5faf66d81dd28ee6ff8c16bc49e9dfac18ca58405","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"7ba22cdb9efcd2e96e2c2c470a1250ff452852c99df9c77f3a8698090b3c7cbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"b3715c7633b17893721514c1a27b06e01964e2499403dcc605dc13d02e574bea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"C04T72pR0Bcl.doc","sha256":"587094eba945fa1541c41ebf93d1b2a61985422f0a7de00a12936a5e55e2d0f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"EKeaJO.doc","sha256":"d9d5c14b6d7f165ce9997bf46bd35056823745782d037018f93512b4719da6f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"F3hzum1.doc","sha256":"8b6b1128bdfc9ee7b9d0f2860d84e7418a99671e4f048ad789adc818627bc9c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"a4cb24b74ae8d47ee0858734acccd596cdfe6e135faf1ebe5f78ab65dd51791c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"a3Ntx.exe","sha256":"6090ace4e82d2666fa46f5857fa0adbbadb0ce5675cecfd32663306975f91a06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"bg3oTe.doc","sha256":"dca19f04b2d6358eda6b1ff54b4eb0123c451f75e38b0d463b88a0ec07a43978","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"bvYkKJ33N9A.exe","sha256":"2b045b1ac38fe17bfb4c4f030391da4d020654cadda8fc11428a2804f5337a95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"dH1rDN9f9.doc","sha256":"0651305fe373576d22b48042d374a5ed2348cf78a104868f1c157ee19c5a9923","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"dgQJde60mPXhI.exe","sha256":"7675aacd40d3b17233e4b02fe418e2ae3d652bf6994889638e2f25adeeace8d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"dskCEJ.exe","sha256":"fdeda24c0af0e32f9311ba51fbdd9a1eff2753f96c8464c690cee01a1a99fb0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"hKY8.doc","sha256":"332966ddefec813223e039387da04bb749ebc6a4a4ed5978e0d3c59e0d04b27a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"hlchPBL.exe","sha256":"476a2797c5dc6d5199792df045e94e9d2e6e6208b95fe5bf262fdef73afb182d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"iLLOga.exe","sha256":"9a14ba9f7d4ed0e4ae23f8dfeb85e0bcb6ff7955e59ee8e4b8f758d72a706173","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"kY01UeAiy5.exe","sha256":"eb936e7b387654cdd436feba86e95ef02626bc2901a2ede286fe97d34853413b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"817895d469b45d2ccc4e1af55bb00169e41f56719e77a64b65220ffeb0d08c9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"klmqz.doc","sha256":"6b5c035a0a608c929f89c73bbf906c1585c7fd31074b21fa782765cc94bd5779","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"3bfca8465b16770f5e53ec4cb7fdf46d68fdef2f13835c19521d6024d9aec290","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"mtgFs8Za.doc","sha256":"3e90952b633dc6cc1a5d52adc062dbe63d4f6225cdcc8d9ea430d405b0b8a696","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"rRgk91Ih5n.doc","sha256":"fd62488b5be460408604eaa0a81b7b825227f4320b8efc6835046a23cee9be35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"tDUzYwYK5f.exe","sha256":"9197fb2003a3cecaec27dcfd8881216933a58728c1bcaf5e9fdcb9ff2d33f647","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"w5JaoO.doc","sha256":"6b6edec98c2ce431975ef43925c95026bd7ee9e707ca873e24b935b41159ce1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"a6c406f7ee4c49d235b01b1be04a2f42243dade5fb84c845b950f9e6313c8893","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Desktop.lnk","sha256":"13126aa549db5d678ac1f029c5179b4717f5565c3fc4beeb08968ca90b108ed9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Downloads.lnk","sha256":"bc8880aaef608ae3a13edf09c485a98c91e171bb32cc25ddbc46fec2694785fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"RecentPlaces.lnk","sha256":"88488b1aa8b60a07476b8c3249bd4393644d399b4adfbb9bb437e6fb9dc486c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"autoexec.bat","sha256":"5638937dab0b8e17179f1d70fe9a254d2ca27d2897814becef143e46e5d20093","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Qt5Gui.dll","sha256":"f2e81038a37ceb198851ddf67b4ac051672f0a74c6e0b12fbbe32517255e4c47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"liblzma-5.dll","sha256":"cd7730a6ec765d908182fb646d5097ac06c2f91b4932d67291635d96a94512bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"capinfos.exe","sha256":"5860de3a2872cdfbc6e0e7f5e7ed18990a61896f8738299b30df0b4b28f0591c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"uninstall.exe","sha256":"66480d26da256d9a5ff74a1a12a31cb2009f8dd8fbf9f2488e5c9fa03bbcde7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libpangowin32-1.0-0.dll","sha256":"62c66726845ce1fa5d8ad65aae75dd780939e218e47fe9473bedbfe5b704261a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libfontconfig-1.dll","sha256":"f3e96dfb5e00bbc91751eb7450cff388d7495ad78f0d9e4b696024008fae0879","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libxml2-2.dll","sha256":"bb1d517cf2878f10182bdc8d3371968187f6cb8fd3cf99cf860194715a65f0b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libatk-1.0-0.dll","sha256":"97973e50cdcf3d985ab750aa26752415d6591b3fb052d25f04a1e9fad09d599f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"WinSparkle.dll","sha256":"737e35c97971e2eda6229136d21f373feb7812b4e2ad15b18b3b9ba945838c13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"UserCache.bin","sha256":"3cf63491fcb48563f6755ca502ce784f59bf1bbd08956b330f777c66419bc121","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libtiff-5.dll","sha256":"c2f75544df9afcc79787f201a117be8f48e8da504f5127358c8891694298af62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libpng15-15.dll","sha256":"d318c9558399f95cfd3b6c55c8b3c5ef4da7e5bc2cfd1e1d3bf26c6605a95f1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"securitypack.jar","sha256":"c816f7ff73d9b5ad23b42e10d41ec8a15ab39b7e013a155bc367af8ab1aa6f90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libpangocairo-1.0-0.dll","sha256":"579d4ac152850dc92ed1795252aa2bfcff29839178314e0c42b8e875f081a704","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libgio-2.0-0.dll","sha256":"06ec0bc56b5f61f0eb27610de4c0cf578dd350d96dd62e0a892876c099706be4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Qt5Widgets.dll","sha256":"4bcc73e92ecc7e08656992203b9b46fb4c78f532253ef0ab88e805c3e9e3304f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libgthread-2.0-0.dll","sha256":"9921d24f87df8519164963924fcab3d52760ff6a62c79cb59d0fbc06e18681a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"rawshark.exe","sha256":"6ac090722deeecf96384b126147ab7ece1d09cbfd1e2e89a63760b82d176b2ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Qt5PrintSupport.dll","sha256":"273b37aaf7753e79ada38111de05aae5e3db6e3c87d7ea4538693f0757492e50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"AcroRead.msi","sha256":"b7aeaaeeb9af4dd75c9c33a40ddfafd3dad4c364e76316f742103bb6a205cb18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libgobject-2.0-0.dll","sha256":"6b90f77f037100bb9fb5f0234baafb2dfe946e982a1b3cb009136554baa143c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libpixman-1-0.dll","sha256":"fbd4a97de09f5076b917138db89c57b5115b677bba9a3b3f40f3bc997ef42011","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Qt5Core.dll","sha256":"180466650931754fbb19e3b25a978245f4ee0b1b57166e0f13bd6435c89c8dba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"javaws.exe","sha256":"5b742332e651067e3abd0ce958a36a56d5803b7b4ddedc97b7d43bddf1a46a99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libharfbuzz-0.dll","sha256":"8f1ce1e30e06d350100b6629fedc83cfcf56b76e081edefc23dbca808fdc4df4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libgtk-win32-2.0-0.dll","sha256":"62e810328a6f9fe2ed08c35618c1b3f4e5b6a117c5e336afa21738be3b929741","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"javaw.exe","sha256":"d5a11b771c7f9defeabbceef650ca9515ea9dc765791eb41fd94d2501c59b0ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libjasper-1.dll","sha256":"1646c9e976e25aaa2b88187bfa90e21b16608a6d30ddb8464b41c39d78eec4c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libfreetype-6.dll","sha256":"1f7a3095bae324616d541baee1ee3e30445e7ed66496ceedc10a6366caeef146","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libjpeg-8.dll","sha256":"149f205cc019a8f5bd205efc49eaadcade7c3773b8d9e9ac8da69dcf94b939fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libpango-1.0-0.dll","sha256":"2ddb19241938cb6534cae1571f5f68741c0cd95103f8892307dfeb9f36298210","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libpangoft2-1.0-0.dll","sha256":"914c399b625a4e2f78c45606783e15ca1221f0436c01ad7de86e677dfad77758","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"java.exe","sha256":"7f4505c4d0ca5172a91c2035851497ea911c742d7403a3aae6b41efc706bc0c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"editcap.exe","sha256":"bed766076d310cfd609dc773fb9265a1ab887032ea05f73036c175ca78a9c742","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libgdk-win32-2.0-0.dll","sha256":"e8b02f8d6d5f47f765ba75d1bcd2b2d161093187ffe42d8151ec01471d48b73c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"text2pcap.exe","sha256":"af6704bcb06c61a211b7f3cab85b50674f8131e7b38b4a9a8b3a472c21636feb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"setup.exe","sha256":"05bb106603c4bc53e185e4d69235328fdc9abf0c406c8a9e8eebdb0ecfe32f7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"mergecap.exe","sha256":"49330904234d3d37fa50578c601b3e68d5293f6e9a62098f3536e500465b7928","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libcairo-2.dll","sha256":"34b94f174f7b8d3862ee2555457dfd967eabff48fc873b56b744a1f7a6f863da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"Wireshark.exe","sha256":"302a577094f5349602b16296ff9cfff51f72fe4266368b8928c60f16ab3ac124","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"WinPcap_4_1_3.exe","sha256":"c07aae2642ff10ab4b05c584642ae4138394c20a7760a058677127dae66e5d2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"user-guide.chm","sha256":"32538fe3902d2e449babb1d204c7dea8afdae0093d8361b5d40a06378f9582ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"qtshark.exe","sha256":"216c4c1163b654d4dfd66a3eaaa46c19b65aace00b1cc6e9f96a4bb04e7d33ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"libgdk_pixbuf-2.0-0.dll","sha256":"48795c1f612061f12ad908c3a602f1033c768e5a30fd7e89ed42a4c566805c94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"name":"reordercap.exe","sha256":"3a9d07277cd805889039e6fe4f749f38cb9c32e782812a9bf037e2cb7960fa39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]}],"files_written":[{"path":"C:\\b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef.exe","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef.exe","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%TEMP%\\__t6D5F.tmp","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\{e29ac6c0-7037-11de-816d-806e6f6e6963}","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\1501536117839$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\1501536117839$OK","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\39g.sq3","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\UF38MJiMCCIPB.EHZ","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\P3xHVlbP5siDKjGJH6Ov.Gky","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\il2JaLASbCsOVxLmmWnf0eB9.SOp","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\fDDvpm0E1.HdG","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\0VdV4A5U1.wjc","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"C:\\Users\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Videos\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%WINDIR%\\system32\\reg.exe","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%WINDIR%\\system32\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%WINDIR%\\system32\\attrib.exe","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%WINDIR%\\system32\\en-US\\attrib.exe.mui","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%WINDIR%\\system32\\en-US\\ulib.dll.mui","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%TEMP%\\__t6D5F.tmp.bat","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Recorded TV\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Pictures\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Music\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Libraries\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Downloads\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Documents\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%PUBLIC%\\Desktop\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Videos\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Searches\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Saved Games\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Pictures\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Music\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Links\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Favorites\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Downloads\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Documents\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Desktop\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%USERPROFILE%\\Contacts\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Wireshark\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\parent.lock","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\webapps\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\idb\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionstore-backups\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\gmp-gmpopenh264\\1.3\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\datareporting\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\crashes\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\!back_files!.html","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\TERMINAL SERVER CLIENT\\SERVERS\\","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\TERMINAL SERVER CLIENT\\","sources":[{"report_type":"sandbox","report_id":"597f9f407ca3e11c284ac153"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["597f9f407ca3e11c284ac153"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample b269b77b38e3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b269b77b38e3…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample b269b77b38e3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b269b77b38e3…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b269b77b38e3fee6e445b04ef8ac9294a6062dc42dcbaf015d134abef308b5ef"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample b269b77b38e3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b269b77b38e3…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]