HOW TO DECRYPT YOUR FILES

26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample b4360cb54f54… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b4360cb54f54…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a"],"about":{"@type":"SoftwareApplication","name":"22 янв.scr","applicationCategory":["peexe","executable"],"identifier":"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8c4,"" wrote 2 bytes to file "C:\USERS\DESKTOP.INI" (Byte Offset: 174): 17547 "" wrote 128 bytes to file "C:\USERS\DESKTOP.INI" (Byte Offset: 176): �D�K�G��瀩܀�1'V��򲾙�*Q�A7$y~UH3�}As!|*�B/L�qؑ�?��g�0��ҁ��.��g��"��YH=�Ԧ��A��8��>�æ<>�jM��o, "" wrote 176 bytes to file "C:\USERS\DESKTOP.INI" (Byte Offset: 0): ��, "" wrote 32 bytes to file "C:\USERS\DESKTOP.INI" (Byte Offset: 1072): ��, "" wrote 16 bytes to file "C:\USERS\DESKTOP.INI" (Byte Offset: 1104): ��, "" wrote 2 bytes to file "C:\USERS\PUBLIC\DESKTOP.INI" (Byte Offset: 174): 40749, "" wrote 128 bytes to file "C:\USERS\PUBLIC\DESKTOP.INI" (Byte Offset: 176): -�1��9��~l��w-w@�~%��F�%V��[��ʉ�}ܓ��L�i�Cl�BL�[;K6�VU��UJ\" wrote 176 bytes to file "C:\USERS\PUBLIC\DESKTOP.INI" (Byte Offset: 0): ��, "" wrote 32 bytes to file "C:\USERS\PUBLIC\DESKTOP.INI" (Byte Offset: 1072): >�Wf�O��O36`�Y_$��.K�Eܛ�, "" wrote 16 bytes to file "C:\USERS\PUBLIC\DESKTOP.INI" (Byte Offset: 1104): ��, "" wrote 4 bytes to file "C:\USERS\PUBLIC\VIDEOS\DESKTOP.INI" (Byte Offset: 380): 2957006725, "" wrote 128 bytes to file "C:\USERS\PUBLIC\VIDEOS\DESKTOP.INI" (Byte Offset: 384): �W@�e�;2��jp��|;�*�RH:~]yL�[No!P�իGV�=I��&[�G��y)4��Jx�e�&쇜��Ɣ��x��S��c��eW~��E��4�y��_KA�HL, "" wrote 384 bytes to file "C:\USERS\PUBLIC\VIDEOS\DESKTOP.INI" (Byte Offset: 0): ��, "" wrote 32 bytes to file "C:\USERS\PUBLIC\VIDEOS\DESKTOP.INI" (Byte Offset: 1280): T@�, "" wrote 16 bytes to file "C:\USERS\PUBLIC\VIDEOS\DESKTOP.INI" (Byte Offset: 1312): �5�بJ��@�˕C28:T1499," HOW TO DECRYPT YOUR FILES

Your personal ID

1F A5 8C 52 3E E7 FB 63 30 B8 D4 64 73 9F D2 6A39 DA AE 29 9B 69 2A 3C A7 01 29 8A AC B5 A7 4D07 D8 01 83 66 C0 A7 EA 7A E1 10 2F 3C AB 83 45CC 60 38 07 0F AE BD 07 92 4A F7 E1 A9 F8 1A C034 FF 33 90 8C 7B AF 08 65 F4 3B 36 70 9D 81 880E 1B D4 A9 40 7F 79 3C 0E 55 F0 73 9A 02 5A E9EB 13 59 15 A4 F8 A4 6F 70 0E F2 D8 92 55 48 73F2 27 D4 D9 8D 0A 52 82 40 76 D5 0A E5 65 D0 F29A FC D8 4D 8D E2 3F F1 49 5E 84 67 70 B3 D7 D41C 6A 87 98 09 E9 F2 FD C2 84 56 34 FC 1C C1 3C2C C2 4C EB 9A C0 58 EB 6C 71 91 41 9F 29 0E 80C4 75 6D E6 CA 04 DF 60 26 45 17 B1 01 1C 30 2FCE 8F 61 AF 6A 00 96 8E 08 1B 76 07 70 21 4B 432E E5 E0 0C EB 55 88 DB 12 7A 4A 6C BF 1E AD B72D BF CF 65 28 51 D0 91 66 E0 8F 2B 33 1C 85 693A 28 3C 27 4A 49 1F 1A 7A 99 89 CA 9B 10 BC 0E

!!! dont changing this !!! -->

-->

tab-->

English

Your files are encrypted!

⬇ To decrypt, follow the instructions below. ⬇

text data --> To recover data you need decryptor.
To get the decryptor you should:

Send 1 crypted test image or text file or document to parbergout@keemail.me
(Or alternate mail parbergout@india.com)
In the letter include your personal ID (look at the beginning of this document).
We will give you the decrypted file and assign the price for decryption all files
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.

MOST IMPORTANT!!!

Do not contact other services that promise to decrypt your files, this is fraud on their part! When you contact them, they will write to sbgpork@tuta.io , and buy the decoder from us, but they will increase the cost of decryption for their services!
text data -->

tab--> text data -->

tab--> " (Source: how_to_back_files.html, Indicator: "decrypt your files") "HOW TO DECRYPT YOUR FILES" (Source: how_to_back_files.html, Indicator: "decrypt your files") " Your files are encrypted! " (Source: how_to_back_files.html, Indicator: "files are encrypted") "
Do not contact other services that promise to decrypt your files, this is fraud on their part!" (Source: how_to_back_files.html, Indicator: "decrypt your files")29:T71c,"" opened "C:\autoexec.bat" with delete access "" opened "C:\config.sys" with delete access "" opened "C:\Users\desktop.ini" with delete access "" opened "C:\Users\Public\desktop.ini" with delete access "" opened "C:\Users\Public\Videos\desktop.ini" with delete access "" opened "C:\Users\Public\Videos\Sample Videos\desktop.ini" with delete access "" opened "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv" with delete access "" opened "C:\Users\Public\Recorded TV\desktop.ini" with delete access "" opened "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" with delete access "" opened "C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "" opened "C:\Users\Public\Pictures\desktop.ini" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Desert.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\desktop.ini" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Koala.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg" with delete access2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeIiIiIiIiIiIiHAAAAAAAIiIiIiIiIiIiIiAAAAAARGIiIiIiIiIiIiIgAAAAAERiIiIiIiIiIiIiHAAAAABGIiIiIiIiIiIiIhwAAAAAXiIiIiIiIiIj4iIcAAAAAF4iIiIiPj///+IiHAAAAABeIiIiI//////+IhwAAAAAXiIiI////////iIcAAAAAF4iI/////////4iHAAAAABeIj//////////4hwAAAAAXiI+I////////+IcAAAAAF4j/eY////////iHAAAAABeI/4iY///////4hwAAAAARj//4iY//iI//+IcAAAAAER////eIh5iI//iIAAAAABEY///4j3iIj//4iAAAAAARGP///4iP////+IgAAAAAERj///+H//////iIAAAAABEY////iP/////4iAAAAAARGP///3j/////+IgAAAAAERj///94//////iIAAAAABEY////iP/////4iAAAAAARGP//////////+IgAAAAAERj///////////iIAAAAABEXiIiIiIiIiIiIhwAAAAAREREREREREREREREAAAAAEREREREREREREREQAAAAAAAAAAAAAAAAAAAAAAAAD///////////gAAB/wAAAPgAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAf/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790720276306,"unified_at":"2026-09-29T22:17:56.306Z","metadata":{"hashes":{"sha256":"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a","sha1":"4da592762e5f7dffdc8fcd9becb1ef0903712422","md5":"0569fdd043344919360e35c9473ca1b1","sha512":"7eca7564bae05a37956cd7e829b1183cd14acae86e27e00bce39ab977f848662ea9affc1262787c9af3c0b82a8d6e24313adc8bbe303396c00d4e9bc26a5fd4c","ssdeep":"6144:Xm4x5KIJcQXTtG+Q8VrDQt+SUJnpjlObXYGOC:Xlx5KIRTtG+Q8Qt+rpj0b0C","ssdeep_chunks":["6144:Xm4x5KI","6144:m4x5KIJ","6144:4x5KIJc","6144:x5KIJcQ","6144:5KIJcQX","6144:KIJcQXT","6144:IJcQXTt","6144:JcQXTtG","6144:cQXTtG+","6144:QXTtG+Q","6144:XTtG+Q8","6144:TtG+Q8V","6144:tG+Q8Vr","6144:G+Q8VrD","6144:+Q8VrDQ","6144:Q8VrDQt","6144:8VrDQt+","6144:VrDQt+S","6144:rDQt+SU","6144:DQt+SUJ","6144:Qt+SUJn","6144:t+SUJnp","6144:+SUJnpj","6144:SUJnpjl","6144:UJnpjlO","6144:JnpjlOb","6144:npjlObX","6144:pjlObXY","6144:jlObXYG","6144:lObXYGO","6144:ObXYGOC","12288:Xm4x5KI","12288:m4x5KIJ","12288:4x5KIJc","12288:x5KIJcQ","12288:5KIJcQX","12288:KIJcQXT","12288:IJcQXTt","12288:JcQXTtG","12288:cQXTtG+","12288:QXTtG+Q","12288:XTtG+Q8","12288:TtG+Q8V","12288:tG+Q8Vr","12288:G+Q8VrD","12288:+Q8VrDQ","12288:Q8VrDQt","12288:8VrDQt+","12288:VrDQt+S","12288:rDQt+SU","12288:DQt+SUJ","12288:Qt+SUJn","12288:t+SUJnp","12288:+SUJnpj","12288:SUJnpjl","12288:UJnpjlO","12288:JnpjlOb","12288:npjlObX","12288:pjlObXY","12288:jlObXYG","12288:lObXYGO","12288:ObXYGOC","6144:Xlx5KIR","6144:lx5KIRT","6144:x5KIRTt","6144:5KIRTtG","6144:KIRTtG+","6144:IRTtG+Q","6144:RTtG+Q8","6144:TtG+Q8Q","6144:tG+Q8Qt","6144:G+Q8Qt+","6144:+Q8Qt+r","6144:Q8Qt+rp","6144:8Qt+rpj","6144:Qt+rpj0","6144:t+rpj0b","6144:+rpj0b0","6144:rpj0b0C"],"imphash":"b3d2c002cefc172f0e4ca836c001d033"},"file_info":{"file_name":"22 янв.scr","file_type":["peexe","executable"],"file_type_id":"exe","file_size":337920,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1516627592000,"last_seen":1617815460000,"last_multi_scan":1617815460000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":13,"suspicious_count":17,"malicious_count":6,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypren.tpfB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Filecoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Crypren","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1128643","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.640020","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_80% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.MHGL-8253","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.640020 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.FV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!4562210D34BE6EE5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Remcos","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00502c261 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Crypren.aexc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.cyn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypren.exdrnz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom_.DFD09FCE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom_.DFD09FCE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.BKAM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Crypren","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 38467-1240-004072A9\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00045714-00003656-63100-82-00409F7C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00045714-00003656-63100-433-00407117\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00045714-00003656-63100-325-00406AF7\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00045714-00003656-58416-1726-004072A9","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00045714-00003656-63100-445-00407009","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00045714-00003656-53456-444-0040FDFF\n EnumSystemLocalesW@KERNEL32.DLL at 00045714-00003656-53456-434-0040F9EE\n GetUserDefaultLCID@KERNEL32.DLL at 00045714-00003656-53456-672-00414F43\n EnumSystemLocalesW@KERNEL32.DLL at 00045714-00003656-53456-666-00414969\n EnumSystemLocalesW@KERNEL32.DLL at 00045714-00003656-53456-664-004148CE\n EnumSystemLocalesW@KERNEL32.DLL at 00045714-00003656-53456-663-00414883\n EnumSystemLocalesW@KERNEL32.DLL at 00045714-00003656-63100-316-004148CC\n EnumSystemLocalesW@KERNEL32.DLL at 00045714-00003656-63100-313-00414967\n GetUserDefaultLCID@KERNEL32.DLL at 00045714-00003656-63100-311-00414F41\n GetUserDefaultLCID@KERNEL32.DLL at 00045714-00003656-63100-286-0040FDFD\n EnumSystemLocalesW@KERNEL32.DLL at 00045714-00003656-63100-312-00414881","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 38467-1335-004151C0\n GetProcessHeap@KERNEL32.DLL at 00045714-00003656-53456-60-00402841\n GetProcessHeap@KERNEL32.DLL at 00045714-00003656-53456-11-00402819\n GetProcessHeap@KERNEL32.DLL at 00045714-00003656-53456-14-004027FF\n GetProcessHeap@KERNEL32.DLL at 00045714-00003656-53456-58-0040282D\n GetProcessHeap@KERNEL32.DLL at 00045714-00003656-53456-874-004151C0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\caught\\weighed\\nurs.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-4162757579-3804539371-4239455898-1000\"\n \"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-4162757579-3804539371-4239455898-1000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for window \"window\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"9rNtWnjTq9RGbU.exe\" has type \"data\"\n \"Calculator.lnk\" has type \"empty \"\n \"MineSweeper.lnk\" has type \"empty \"\n \"Paint.lnk\" has type \"empty \"\n \"Sticky Notes.lnk\" has type \"empty \"\n \"Windows Media Player.lnk\" has type \"empty \"\n \"Adobe Reader XI.lnk\" has type \"data\"\n \"yZw6snqBQ28DAzu.exe\" has type \"data\"\n \"MineSweeper.lnk\" has type \"data\"\n \"rRgk91Ih5n.doc\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"securitypack.jar\" has type \"data\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"C04T72pR0Bcl.doc\" has type \"data\"\n \"Desktop.lnk\" has type \"data\"\n \"w5JaoO.doc\" has type \"data\"\n \"6WMjwc1zqk3IB.exe\" has type \"data\"\n \"tDUzYwYK5f.exe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\imaadp32.acm.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msg711.acm.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msgsm32.acm.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msadp32.acm.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\l3codeca.acm.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msacm32.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\setupapi.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msvfw32.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\avicap32.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.inkscape.org\"\n Heuristic match: \"Font.Name\"\n Heuristic match: \"sbgpork@tuta.io\"\n Heuristic match: \"When you contact them, they will write to sbgpork@tuta.io\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00045714-00003656-00000105-116074730","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Writes to a desktop.ini file (may be used to cloak folders)","description":"$27","origin":"API Call","relevance":3,"id":"api-34","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.75144795991","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00045714-00003656-63100-20-004073A6","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%LOCALAPPDATA%\\b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.24/31, 192.168.56.27/32, ...\"","origin":"Network Traffic","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$28","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 620 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExA\n OpenFileMappingA\n WriteFile\n OutputDebugStringA\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExA\n UnhandledExceptionFilter\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n GetModuleHandleExA\n LoadLibraryA\n GetFileSize\n GetStartupInfoW\n FindFirstFileExA\n FindNextFileA\n GetProcAddress\n CreateFileW\n CreateFileA\n GetCommandLineW\n GetCommandLineA\n MapViewOfFile\n GetModuleHandleA\n GetModuleHandleW\n FindWindowA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Opens many files with write access (often indicator for full-system infection)","description":"\"\" opens more than 500 files with write access","origin":"API Call","relevance":10,"id":"api-49","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe.bin\" has a section named \".text1\"\n \"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe.bin\" has a section named \".data1\"\n \"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe.bin\" has a section named \".gfids\"\n \"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe.bin\" has a section named \".trace\"\n \"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe.bin\" has a section named \"_RDATA\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%LOCALAPPDATA%\\b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe.bin\" (Offset: 21798)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"18/66 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"18/66 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryVirtualMemory@NTDLL.DLL at 00045714-00003656-53456-147-00402489","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":63,"files_written_count":84,"files_deleted_count":0,"registry_keys_created_count":16,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":16,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5a65d0ce7ca3e1263e59b895","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware","submit_name":"22 янв.scr","analysis_start_time":"2018-01-23T02:23:25+00:00","indicators_count":{"informative":13,"suspicious":20,"malicious":7},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}],"processes":[{"pid":3656,"ppid":0,"name":"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe","command_line":"","sha256":"b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a","normalized_path":"C:\\b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe","uid":"00045714-00003656","icon":"$2a"}],"all_imported_dlls":["devenum.dll","Wldap32.dll","lpk.dll","ole32.dll","wintrust.dll","msasn1.dll","avicap32.dll","msvfw32.dll","shlwapi.dll","ntdll.dll","user32.dll","winmm.dll","comctl32.dll","crypt32.dll","msdmo.dll","version.dll","advapi32.dll","winsta.dll","rpcss.dll","rsaenh.dll","KernelBase.dll","shell32.dll","oleaut32.dll","wtsapi32.dll","uxtheme.dll","rasapi32.dll","rasman.dll","nsi.dll","rpcrt4.dll","msacm32.dll","clbcatq.dll","setupapi.dll","devobj.dll","imm32.dll","msctf.dll","rtutils.dll","ntmarta.dll","msvcrt.dll","ws2_32.dll","sspicli.dll","cfgmgr32.dll","cryptsp.dll","tapi32.dll","kernel32.dll","gdi32.dll","usp10.dll","sechost.dll","cryptbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"how_to_back_files.html","sha256":"19e7192467711feef9375da90bbd694d6469bf9764749456040579b40d1bc530","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Calculator.lnk","sha256":"979dd234ac0baa42d637bd6d30e8ea1a1effce85a724d2476f2877e2e9ff160c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"MineSweeper.lnk","sha256":"2c2d6b202f00912996580ed6f2badde24d3fc3223792cd58d34d4932159cd63a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Paint.lnk","sha256":"78a10b5cb14e006c010de401c4036e3464191805b80393a67a0da062ffce8cd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Sticky Notes.lnk","sha256":"aec94ad67e68399a474f5907355a17ef412200a56bb007d9702881c723dd9b6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Windows Media Player.lnk","sha256":"b862b07f888b929a9de4947a754ade558541949f82641967768f28a0dae5cac2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"GlobData","sha256":"8ebba094c577b2aa3cfb17ce31f47b77d44cca041a01bf59f380d80cf2f2ecc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"GlobSettings","sha256":"e70c1ac22e7feb665b4843cd01e98867952ee8a8749bfb32716234c2e5b59bbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"0ff85fc7a5a8dc867110e51d8d3f3ce2b22c02564da745da50e15f3442f2d8c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"641af0de73ebf9963d01365c1ed47f0e8340ea567661dba3861230a63c99c8d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"addressbook.acrodata","sha256":"9b16a4c9cb9e5a1a4999bcaeaf8475dcdbbacafa1ed0e5be915b4d5c6dca1515","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"directories.acrodata","sha256":"6c57c7561002b231485e00e53a1d1071906754129b662b9e751cd4891f5be083","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"services_rdr.dat","sha256":"29c68c4e9b433bab60f0d22f4996381a73b2d05058208017a60f8c046c93417c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"services_rdri.dat","sha256":"cf8cd31b2dc4257c6413906a351a780a0d586fd01121d0fa21915fdf55bdfa63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"services_rdrk.dat","sha256":"1e64ead375c96b9b973f93b86e8bbd53af7ac388376041b2e6b3d4a6061825bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"InstallTime20150122214805","sha256":"2cf39ba13b24f4cc28bcb39bdb5857148663b95ee817ac752fa1d5310ece24a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"SiteSecurityServiceState.txt","sha256":"d7a4ebde4caffe10d93f3f4f8ae9bde53a2c03a8cba4d523da7576d337c1240f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Telemetry.FailedProfileLocks.txt","sha256":"04b88f945d78a27f5790b62bc7d3f7a0053a0fc6912d80d1d1b012b936b6d922","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"addons.json","sha256":"63da15923f66150d8d539ccecd0fa083a9b5920dab75068f7ca3870dc8d7f38e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"blocklist.xml","sha256":"8a4738fa1fc7c2e9a85cf7a9b4d4b2979d462b1e9ce6ef53aaef6bcdc25fe2de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"cert8.db","sha256":"64d542fae4b658005eb545270bf05e371893b704241fafbb9d57dcb5d7a7742b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"compatibility.ini","sha256":"7f78a182a52033f569822a88fb35cc96358fc3a33b17e3c1acdb3de763c952da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"content-prefs.sqlite","sha256":"88d8fba9932db6f36365662a05e31f9006f12efab522cfea73b7c693bb93c6de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"cookies.sqlite","sha256":"e33222465c36bdebe8f3b6a8a51339e70f9f201ee274f52c956c12137891e770","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"store.json.mozlz4","sha256":"68b3f5d8beeafbd4b1fad9d09df17d9e8a360c48bb114e050b7e47d4bc6dde19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Adobe Reader XI.lnk","sha256":"3f2f7658db58060862b1748d05f62752323f6eab790becc9fbfe14ef77d156f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Google Chrome.lnk","sha256":"161c5640b6c3d7d45efcee434cad28afd5fdacc7a8de9d027f6a80408608cae3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Mozilla Firefox.lnk","sha256":"a3b7d19a7345cb306523f7c00dca62662ec8bbb8bafccb2eecfd0a0136bbfda7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"b630ed85df4732ba6732d75b3bd223a1667127625466bb59f4e84e78c78c8394","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"f5e0dbf00c10ef56515e5f264f9eb3dd5cbcba1384684a9eb966157234b39e2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"0zIG0D.doc","sha256":"1b41f8e368c922b8b4cfe4784b308197e510a1f63d651931e5e5897976c2ae1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"c431cea1c52817833467d08a603b722384590e7fa94b268f440c466acb1808eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"2df479b27d394b8aa8032b17fd7f8556009d68b0aa9f7fee71f3d2bb44d3561b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"6SZfLTu9z.doc","sha256":"8c210fafe3485759b7efdd0fc37e10f2becbb63ef6774b33dcb16642e67937ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"2386d1424726757eba5243191e9cfdedcf2e011618a9b491f24e2002c2ad4c58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"0a980b4a54a77effaf252ec4ea6f8a6ab203a5cc9d4afee2b4851667379d1a12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"C04T72pR0Bcl.doc","sha256":"4dda52e2abc58d3a68ef3fb72adaa34af03b3478a200378463d23db968cc8d71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"EKeaJO.doc","sha256":"e19bbe86df663c321b0ea9c62f7f2e6cc091a3e6b0daff6a1bdc4f3be975780d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"F3hzum1.doc","sha256":"53a92a2dea0a36ecd981b35c4374a6803361baad5d5b0ccb0ff5e1cce2d70e20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"2730fdebd6fda319a839c26f868b311723c9cd84555637c8e94ce981a95f79d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"a3Ntx.exe","sha256":"5ea77cebaf71cc888d68d2505c895faf5ff06a29fbb7aa934685859480dd22d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"bg3oTe.doc","sha256":"56aeb0b5eccd9d4c25907d52c940c41437e58371c3c8d28f91ae4bbafe29bda2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"bvYkKJ33N9A.exe","sha256":"b6903833dc0723807e581d677eac0764252ef87e0275899abaac0cdde10693b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"dH1rDN9f9.doc","sha256":"80cd672ca4c4afebe1f16ed6dfef9c0be2b6ed17b7fdb670d66af5eca8c36919","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"dgQJde60mPXhI.exe","sha256":"31c4c7117180834a250a6146b23cf06b8dd959cd1c6f5bed0175deaf5d921520","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"dskCEJ.exe","sha256":"baa28147d51991d415c79c425b8ade60311c1b7b048450c9cef9d14147afd2f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"hKY8.doc","sha256":"441e93384f733504aa5fa038a055274fa1b44fabf4ae76801ed41cc2e5d168db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"hlchPBL.exe","sha256":"71852f98f9bce82761b1a3de750b874c79fc70ef83d8a9ba183c6d1076584fd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"iLLOga.exe","sha256":"1ef437e776fe766202909e580d11e9c37de5e347833c147e7b3892c7fd5d6cfc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"kY01UeAiy5.exe","sha256":"10a6c681487e519216de4ed696b52c8b5293147583f428f33428376c28b95c9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"9ffaa0c33b72b5ce822dd3fe9fa2e1c6f623e4b1e82cfdb555d5160f7dccec55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"klmqz.doc","sha256":"28af92c27d37186c6eb69e4433039947c2a53328d6010eb999b53a37a7bc4000","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"ea3f98f4eab7b0e6f600e13d0fb129b83498a1df7ff292222bf709c6edec902a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"mtgFs8Za.doc","sha256":"2fde0ad63733a11345949ee7b6f6bae5fc004308f494258fa22487d919239ee4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"rRgk91Ih5n.doc","sha256":"506e5c12dd38317d50e7d2114d39105691c8bcd309fbc4aa7426f2dc2b91b15d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"tDUzYwYK5f.exe","sha256":"3e167f55b60e5271698dac328f7c7cb9921c69ad160bff1f249547e72d4543fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"w5JaoO.doc","sha256":"d89fc75378c3ad5f791d11e98129f91a68ac845a6529a1a4e49d6fff5131953e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"7fd7b21b6df1dc8c90be2d1787581496507501324b1e3e047ecfcf0abead1a6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Desktop.lnk","sha256":"c02287cc4a7713dd8631e65cfff3da0cb3d07a947e9b0555668c72d3bfea17d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"Downloads.lnk","sha256":"59e889a31d93ec71a4a15310af346c1984496e5496dbb1625f3bd87dc45aa84e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"RecentPlaces.lnk","sha256":"f9286a1ea6e6818e3096190b08bd44e0d7e1548d384de6334d1180df235affca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"autoexec.bat","sha256":"5d4f3fe11eb7965e11d61a49e8a0b3c536a60238e065a86fd4dbd36736833be5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"securitypack.jar","sha256":"184105f0c667ecb6b2ca16d30dcb2c60152535aa93bc238829d8c3e7ac9c4ee9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\en-US\\imaadp32.acm.mui","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\en-US\\msg711.acm.mui","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\en-US\\msgsm32.acm.mui","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\en-US\\msadp32.acm.mui","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\en-US\\l3codeca.acm.mui","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\en-US\\msacm32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\å","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\en-US\\msvfw32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\en-US\\avicap32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%LOCALAPPDATA%\\b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%LOCALAPPDATA%\\b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\BC7FB024EE90642085F9713EBF446715FAB690B2311290E34BEDA626E8D9F375","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\1516670638740$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\1516670638740$OK","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\2Mz.iHG","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\WORHy7Yc9CzQU.tyq","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\bgwlM457IFcOU5tFdILQ.gFA","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\xo0vDPSe7fnhs6FFzHmweAIn.4OU","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\ZJ7727RIJ.yxV","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\2jX1fHtRx.XZZ","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"C:\\Users\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Recorded TV\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Libraries\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Downloads\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Documents\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%PUBLIC%\\Desktop\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Searches\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Searches\\Everywhere.search-ms","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Saved Games\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Links\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Favorites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Downloads\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Documents\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Desktop\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%USERPROFILE%\\Contacts\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Wireshark\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\parent.lock","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\webapps\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\idb\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionstore-backups\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\gmp-gmpopenh264\\1.3\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\datareporting\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\crashes\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\AUDIOCOMPRESSIONMANAGER\\DRIVERCACHE\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\AUDIOCOMPRESSIONMANAGER\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\AUDIOCOMPRESSIONMANAGER\\DRIVERCACHE\\MSACM.IMAADPCM\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\AUDIOCOMPRESSIONMANAGER\\DRIVERCACHE\\MSACM.MSG711\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\AUDIOCOMPRESSIONMANAGER\\DRIVERCACHE\\MSACM.MSGSM610\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\AUDIOCOMPRESSIONMANAGER\\DRIVERCACHE\\MSACM.MSADPCM\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\AUDIOCOMPRESSIONMANAGER\\DRIVERCACHE\\MSACM.L3ACM\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\MULTIMEDIA\\AUDIO COMPRESSION MANAGER\\\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\MULTIMEDIA\\AUDIO COMPRESSION MANAGER\\MSACM\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\MULTIMEDIA\\AUDIO COMPRESSION MANAGER\\PRIORITY V4.00\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\MEDIARESOURCES\\MSVIDEO\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a65d0ce7ca3e1263e59b895"}]}]}},"report_ids":{"sandbox_job_ids":["5a65d0ce7ca3e1263e59b895"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample b4360cb54f54… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b4360cb54f54…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample b4360cb54f54… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b4360cb54f54…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b4360cb54f54f5df9df8f4a176ba96a77a624e67b084221e216c83d277fc088a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample b4360cb54f54… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b4360cb54f54…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]