26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL_Heur Sample c0e2e1e4d71c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c0e2e1e4d71c…. Malware family: Trojan.MSIL_Heur. Threat score 100/100. 2/27 AV engines flagged this file. 13 malicious and 41 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724","keywords":["Malicious","Trojan.MSIL_Heur","malware analysis","sandbox report","threat intelligence","c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724"],"about":{"@type":"SoftwareApplication","name":"xvirus-setup.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MSIL_Heur","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":41},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T431,"GET /download/amv.txt HTTP/1.1 Host: xvirus.net Connection: Keep-Alive" "GET /database/maindb.txt HTTP/1.1 Host: cloud.xvirus.net Connection: Keep-Alive" "GET /database/dailydb.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/heurdb.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/heurdb2.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/wv.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/dailywv.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/rv.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/vendornumber.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/compv.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/viruslist.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/heurlist2.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/dailywl.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/dailylist.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/malvendor.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/heurlist.txt HTTP/1.1 Host: cloud.xvirus.net" "GET /database/whitelist.txt HTTP/1.1 Host: cloud.xvirus.net"28:T85e,"Xvirus.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Wed Sep 20 17:45:52 2017 mtime=Wed Sep 20 17:45:52 2017 atime=Wed Sep 20 17:45:52 2017 length=1957376 window=hide" "shellfile.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "shellfolder.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "VoodooAi.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "Features.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows" "xvirusstart.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "Xvirus Anti-Malware.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "xvirusupdate.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "Unin.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "xvirusAR.doc" has type "Composite Document File V2 Document Little Endian Os: Windows Version 10.0 Code page: 1252 Author: Dani Santos Template: Normal Last Saved By: Dani Santos Revision Number: 1 Name of Creating Application: Microsoft Office Word Total Editing Time: 01:00 Create Time/Date: Sun Jan 8 14:40:00 2017 Last Saved Time/Date: Sun Jan 8 14:41:00 2017 Number of Pages: 1 Number of Words: 6 Number of Characters: 35 Security: 0" "crvoolec.newcfg" has type "XML 1.0 document ASCII text with CRLF line terminators" "j0kb4srt.newcfg" has type "XML 1.0 document ASCII text with CRLF line terminators" "gxjbpe0m.newcfg" has type "XML 1.0 document ASCII text with CRLF line terminators" "German (Deutsch).lng" has type "UTF-8 Unicode text with CRLF line terminators" "Spanish (espaol).lng" has type "UTF-8 Unicode text with CRLF line terminators" "Estonian (Eesti).lng" has type "UTF-8 Unicode text with CRLF line terminators" "reglist2.xdb" has type "UTF-8 Unicode (with BOM) text" "whitelist2.xdb" has type "ASCII text" "heurlist.xdb" has type "ASCII text with CRLF line terminators"29:T6c3,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\config\machine.config" "" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll.aux" "" touched file "C:\Windows\assembly\pubpol47.dat" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\b8de0f79bc74f6c423e1c719ee7afefd\Microsoft.VisualBasic.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\250e8e6af918e7ca66787117bc8633e3\System.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\75790ba48ebfa82fae7da9a114bc9886\System.Core.ni.dll.aux"2a:T1a14,Pattern match: "http://www.xvirus.net/" Pattern match: "http://www.usertrust.com1" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://sf.symcb.com/sf.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sf.symcd.com0&" Pattern match: "http://sf.symcb.com/sf.crt0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://crl.verisign.com/pca3-g5.crl04" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://www.webnest.net" Pattern match: "http://schemas.openxmlformats.org/drawingml/2006/main" Pattern match: "http://login.xvirus.net/removelic.php" Pattern match: "http://www.xvirus.net/submit" Pattern match: "http://login.xvirus.net/procscan.php" Pattern match: "http://xvirus.net/download/amv.txt" Pattern match: "http://cloud.xvirus.net/database/maindb.txt" Pattern match: "http://cloud.xvirus.net/database/dailydb.txt" Pattern match: "http://cloud.xvirus.net/database/heurdb.txt" Pattern match: "http://cloud.xvirus.net/database/heurdb2.txt" Pattern match: "http://cloud.xvirus.net/database/wv.txt" Pattern match: "http://cloud.xvirus.net/database/dailywv.txt" Pattern match: "http://cloud.xvirus.net/database/rv.txt" Pattern match: "http://cloud.xvirus.net/database/vendornumber.txt" Pattern match: "http://cloud.xvirus.net/database/compv.txt" Pattern match: "http://cloud.xvirus.net/cloudscan.php" Pattern match: "http://login.xvirus.net/procstatus.php" Pattern match: "http://cloud.xvirus.net/database/viruslist.txt" Pattern match: "http://cloud.xvirus.net/database/dailylist.txt" Pattern match: "http://cloud.xvirus.net/database/heurlist.txt" Pattern match: "http://cloud.xvirus.net/database/heurlist2.txt" Pattern match: "http://cloud.xvirus.net/database/whitelist.txt" Pattern match: "http://cloud.xvirus.net/database/dailywl.txt" Pattern match: "http://cloud.xvirus.net/database/reglist.txt" Pattern match: "http://cloud.xvirus.net/database/malvendor.txt" Pattern match: "http://cloud.xvirus.net/database/complist.txt" Pattern match: "http://www.xvirus.net" Pattern match: "https://www.facebook.com/mikevdigitaldesigns" Pattern match: "http://xvirus.net/submit" Pattern match: "https://who.is/whois-ip/ip-address/" Pattern match: "http://cloud.xvirus.net/submitvote.php" Pattern match: "http://login.xvirus.net/" Pattern match: "http://xvirus.net/download/amurl.txt" Heuristic match: "support@xvirus.net" Heuristic match: "key|hkcu|Software\nuevos-programas.com" Heuristic match: "key|hkcu|Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com" Heuristic match: "key|hkml|SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com" Heuristic match: "key|hkml|SOFTWARE\MozillaPlugins\@staging.google.com" Heuristic match: "key|hkml|SOFTWARE\dll-files.com" Heuristic match: "key|hkcu|Software\Ask.com" Heuristic match: "key|hkcu|Software\facemoods.com" Heuristic match: "key|hkml|SOFTWARE\facemoods.com" Heuristic match: "key|hkcu|Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\istartsurf.com" Heuristic match: "key|hkcu|Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\mystartsearch.com" Pattern match: "www.mystartsearch.com" Heuristic match: "key|hkml|SOFTWARE\MozillaPlugins\@tools.updatepm.com" Heuristic match: "key|hkml|SOFTWARE\komputerswiat.pl" Heuristic match: "key|hkcu|SOFTWARE\komputerswiat.pl" Heuristic match: "key|hkml|SOFTWARE\incredibar.com" Heuristic match: "key|hkcu|Software\incredibar.com" Heuristic match: "key|hkml|Software\incredibar.com" Heuristic match: "key|hkcu|Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\babylon.com" Heuristic match: "key|hkcu|Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com" Heuristic match: "key|hkcu|Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com" Heuristic match: "key|hkcu|Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.pl" Heuristic match: "key|hkcu|Software\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com" Pattern match: "www.superfish.com" Heuristic match: "key|hkcu|Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\isearch.omiga-plus.com" Heuristic match: "key|hkcu|Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\omiga-plus.com" Heuristic match: "key|hkcu|Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\trovi.com" Pattern match: "www.trovi.com" Heuristic match: "key|hkcu|Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\key-find.com" Pattern match: "www.key-find.com" Heuristic match: "key|hkml|SOFTWARE\MozillaPlugins\@qq.com" Heuristic match: "key|hkcu|Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com" Heuristic match: "key|hkcu|Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com" Pattern match: "checkpoint.com/FFApi" Pattern match: "tools.dpliveupdate.com/DealPlyLive" Heuristic match: "#e-mail=support@xvirus.net" Heuristic match: "xvirus.net" Heuristic match: "cloud.xvirus.net" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "#e-mail=support@mysecuritywin.com" Heuristic match: "#e-mail=Secondmineboy@outlook.com" Heuristic match: "xvirusstart.My" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "Unin.My" Pattern match: "xvirus.net/removelic.php" Heuristic match: "xvirusupdate.My" Pattern match: "xvirus.net/download/amurl.txt" Heuristic match: "XvirusAM.My" Pattern match: "www.xvirus.net/submit" Pattern match: "virus.net/download/amv.txt" Pattern match: "us.net/database/dailydb.txt" Pattern match: "rus.net/database/heurdb2.txt" Pattern match: "d.xvirus.net/database/dailywv.txt" Pattern match: "cloud.xvirus.net/database/vendornumber.txt" Pattern match: "cloud.xvirus.net/cloudscan.php" Pattern match: "s.microsoft.com/windows/2004/02/mit/task" Pattern match: "virus.net/database/viruslist.txt" Pattern match: "virus.net/database/heurlist.txt" Pattern match: "irus.net/database/whitelist.txt" Pattern match: "xvirus.net/database/reglist.txt" Pattern match: "irus.net/database/complist.txt" Pattern match: "www.xvirus.net" Pattern match: "xvirus.net/submit" Pattern match: "ud.xvirus.net/submitvote.php" Pattern match: "http://www.xvirus.net/purchase" Heuristic match: "shellfile.My" Heuristic match: "shellfolder.My"2b:T17a4,"-69-6F-6E-00-4C-6F-61-64-00-47-65-74-54-79-70-65-73-00-47-65-74-4D-65-74-68-6F-64-73-00-44-6C-6C-49-6D-70-6F-72-74-41-74-74-72-69-62-75-74-65-00,Suspicious:NewThreat.6 70-00-72-00-69-00-6E-00-74-00-42-00-79-00-57-00-6F-00-72-00-64,Trojan.Torrentlocker.7 3F-00-3F-00-57-00-4F-00-52-00-44-00-3F-00-3F-00-3F-00-3F,Trojan.Torrentlocker.8 2E-65-2E-72-65-73-6F-75-72-63-65-73-00-00,Suspicious:NewThreat.9 20-EB-2D-1C-64-8A-43-4F-64-8A-43-4F-64-8A-43-4F-A7-85-1E-4F-6E-8A-43-4F-E7-96-4D-4F-67-8A-43-4F-0B-95-49-4F-6F-8A-43-4F-0B-95-47-4F-66-8A-43-4F-52-AC-48-4F-67-8A-43-4F-52-AC-47-4F-67-8A-43-4F-64-8A-42-4F-FC-8A-43-4F-8C-95-48-4F-60-8A-43-4F-A3-8C-45-4F-65-8A-43-4F-52-69-63-68-64-8A-43-4F,Trojan.Torrentlocker.10 77-00-69-00-6E-00-38-00-5F-00-72-00-74-00-6D-00-2E-00-31-00-32-00-30-00-37-00-32-00-35-00-2D-00-31-00-32-00-34-00-37,Trojan.Torrentlocker.11 77-39-70-99-33-58-1E-CA-33-58-1E-CA-33-58-1E-CA-3A-20-9A-CA-32-58-1E-CA-28-C5-B5-CA-10-58-1E-CA-28-C5-80-CA-23-58-1E-CA-28-C5-B4-CA-5C-58-1E-CA-3A-20-9D-CA-31-58-1E-CA-3A-20-8D-CA-24-58-1E-CA-33-58-1F-CA-82-58-1E-CA-28-C5-B1-CA-25-58-1E-CA-28-C5-85-CA-32-58-1E-CA-28-C5-83-CA-32-58-1E-CA-52-69-63-68-33-58-1E-CA-00-00-00-00-00-00-00-00,Suspicious:NewThreat.12 4E-00-61-00-6D-00-65-00-00-00-44-00-65-00-74-00-65-00-63-00-74-00-69-00-6E-00-67-00-42-00-6F-00-61-00-43-00-61-00-6C-00-6C-00,Trojan.CryptoWall.14 43-6F-64-65-41-74-74-72-69-62-75-74-65-00-44-61-6E-67-6C-65-64-46-65-64-65-72-61-74-65-2E-52-65-73-6FA" (Source: network.pcap, Indicator: "cryptowall") "0-00-00-43-00-6C-00-69-00-65-00-6E-00-74-00-00-00-00,Suspicious:NewThreat.185 6E-00-61-00-6D-00-65-00-00-00-32-00-35-00-30-00-31-00-2E-00-65-00-78-00-65-00,Suspicious:NewThreat.186 EC-15-7F-C8-A8-74-11-9B-A8-74-11-9B-A8-74-11-9B-2B-68-1F-9B-A9-74-11-9B-FE-6B-02-9B-AD-74-11-9B-A8-74-10-9B-24-75-11-9B-CA-6B-02-9B-B7-74-11-9B-A8-74-11-9B-DF-74-11-9B-40-6B-1A-9B-AA-74-11-9B-10-72-17-9B-A9-74-11-9B-52-69-63-68-A8-74-11-9B,Trojan.CryptoWall.187 67-00-70-00-69-00-62-00-6B-00-67-00-2E-00-45-00-58-00-45,Suspicious:NewThreat.188 DB-89-B5-22-9F-E8-DB-71-9F-E8-DB-71-9F-E8-DB-71-11-F7-C8-71-80-E8-DB-71-B8-2E-A0-71-94-E8-DB-71-9F-E8-DA-71-B4-E8-DB-71-81-BA-58-71-9E-E8-DB-71-9F-E8-DB-71-9D-E8-DB-71-81-BA-4F-71-9E-E8-DB-71-81-BA-4A-71-9E-E8-DB-71-52-69-63-68-9F-E8-DB-71,Backdoor.Simda.189 47-00-4E-00-45-00-52-00-2C-00-20-00-43-00-6F-00-72-00-65-00-6C-00-20-00-52-00-2E-00-41-00-2E-00-56-00-2E-00-45-00-2E-00-2C-00-20-00-43-00-6F-00-72-00-65-00-6C-00-20-00-50-00-48-00-4F-00-54-00-4F-00-2D-00-50-00-41-00-49-00-4E-00-54-00-2C-00-20-00-43-00-6F-00-72-00-65-00-6C-00-54-00-52-00-41-00-43-00-45-00-20-00-61-00-6E-00-64-00-20-00-43-00-6F-00-72-00-65-00-6C-00-20-00-43-00-41-00-50-00-54-00-55-00-52-00-45-00-20-00-61-00-72-00-65-00-20-00-74-00-72-00-61-00-64-00-65-00-6D-00-61-00-72-00-6B-00-73-00-20-00-6F-00-72-00-20-00-72-00-65-00-67-00-69-00-73-00-74-00-65-00-72-00-65-00-64-00-20-00-74-00-72-00-61-00-64-00-65-00-6D-00-61-00-72-00-6B-00-73-00-20-00-6F-00-66-00-20-0A" (Source: network.pcap, Indicator: "cryptowall") "-01-00-54-02-16-57-72-61-70-4E-6F-6E-45-78-63-65-70-74-69-6F-6E-54-68-72-6F-77-73-01-00-00-00-00,Trojan.CryptoWall.389 46-00-69-00-6C-00-65-00-6E-00-61-00-6D-00-65-00-00-00-53-00-74-00-75-00-62-00-2E-00-65-00-78-00,Suspicious:NewThreat.390 15-CD-AA-68-51-AC-C4-3B-51-AC-C4-3B-51-AC-C4-3B-28-8D-CF-3B-50-AC-C4-3B-3E-B3-CF-3B-58-AC-C4-3B-D2-B0-CA-3B-44-AC-C4-3B-3E-B3-CE-3B-11-AC-C4-3B-33-B3-D7-3B-56-AC-C4-3B-51-AC-C5-3B-07-AC-C4-3B-05-8F-F5-3B-55-AC-C4-3B-96-AA-C2-3B-50-AC-C4-3B-AE-8C-C0-3B-50-AC-C4-3B-52-69-63-68-51-AC-C4-3B,Trojan.FakeAV.392 6A-71-6F-75-76-77-69-6B-74-63-70-00-72-68,Trojan.FakeAV.393 57-69-6E-64-6F-77-73-41-70-70-6C-69-63-61-74-69-6F-6E-31-2E-70-64-62,Suspicious:NewThreat.394 24-86-A4-13-60-E7-CA-40-60-E7-CA-40-60-E7-CA-40-39-C4-D9-40-62-E7-CA-40-60-E7-CB-40-64-E7-CA-40-88-F8-C1-40-61-E7-CA-40-E3-FB-C4-40-6A-E7-CA-40-88-F8-C0-40-49-E7-CA-40-36-F8-D9-40-68-E7-CA-40-BA-C4-D6-40-69-E7-CA-40-90-F8-C1-40-70-E7-CA-40-60-E7-CA-40-48-E6-CA-40-52-69-63-68-60-E7-CA-40,Trojan.FakeAV.395 43-00-6F-00-70-00-79-00-72-00-69-00-67-00-68-00-74-00-20-00-A9-00-20-00-20-00-28-75-E1-4F-22-8C-59-4F-22-4E-0F-5F-68-88-1F-61-68-88-59-4F-48-4E-0E-60-F6-5E-53-4E-53-4E-48-51-53-4E-28-75-68-88-4E-53-87-65-87-65-B9-65-F1-82-32-00-30-00-31,Suspicious:NewThreat.396 12-24-81-71-56-45-EF-22-56-45-EF-22-56-45-EF-22-C1-81-91-22-54-45-EF-22-71-83-81-22-62-45-EF-22-71-83-82-22-96-45-EF-22-95-4A-B0-22-5F-45-EF-22-95-4A-B2-22-4D-45-EF-22-56-45-EE-22-80-44-EF-22-A" (Source: network.pcap, Indicator: "cryptowall") "D7-6F-29-64-D7-6F-29-64-D7-6F-29-64-14-60-74-64-DF-6F-29-64-54-73-27-64-D5-6F-29-64-B8-70-23-64-DC-6F-29-64-B8-70-2D-64-D5-6F-29-64,Suspicious:NewThreat.458 E1-49-22-64-D4-6F-29-64-E1-49-2D-64-D4-6F-29-64-D7-6F-28-64-F0-6E-29-64-3F-70-22-64-DD-6F-29-64-10-69-2F-64-D6-6F-29-64-52-69-63-68-D7-6F-29-64,Suspicious:NewThreat.459 45-DF-FF-FE-FD-FD-44-E8-97-34-ED-97-79-8D-A7-8D-A9-80-43-54-24-34-B2-32-42-81-23-70-FF,Trojan.Cryptolocker.460 DD-93-40-49-54-08-45-38-54-38-28-73-DA-AA-FF-FF-ED-E9-89-43-73-58-74-23-87-37-84-39-84-38-29-04-97-32-97-4F-FD-F3-42-33-42-34-24-23-43-24-23-42-34-23-30,Trojan.Cryptolocker.461 87-18-0D-73-C8-80-34-66-85-48-A8-70-3C-93-1D-EF-4A-D9-3D-57-D3-13-C9-A2-13-A0-5A-0C-71-2A-63-8C-AC-71-AD-E5-87-75-D5-80-EE-CB-0C-05-49-EA-E2-9B,Trojan.Ransom.locker.13.462 64-61-74-61-5F-69-6E-6A-65-63-74-0D,Trojan.Betabot.463 4E-00-61-00-6D-00-65-00-00-00-00-00-73-00-64-00-66-00-64-00-64-00-64,Suspicious:NewThreat.464 E4-89-1A-BF-87-9D-FF-C1-82-13-DC-F1-D3-0E-D6-FB-B9-C3-C5-B4-CB-8C-CF-5D-F6-49-34-C1-3C-31-C2-C3-9F-64-65-A8-7C-2A-3F-DB-10-C4-B0-C2-C3-48-D2-22-41-11-83-74-4F-91-08-BF-ED-76-09-83-FC-06-49-71,Trojan.Betabot.466 4C-61-73-74-41-56-00-4C-61-73-74-41-53,Backdoor.njRAT.467 15-73-00-65-00-72-00-76-00-65-00-72-00-2E-00-65-00-78-00-65,Suspicious:NewThreat.468 00-00-73-00-65-00-72-00-76-00-65-00-72-00-2E-00-65-00-78-00-65,Suspicious:NewThreat.469 42-79-45-4C-44-49,Riskware.KMSActivator.470 57-69-6E-64-6F-77-73-20-4C-6F-61-64-65-A" (Source: network.pcap, Indicator: "cryptolocker")2c:T793,"XvirusAnti-MalwarePro.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}") "XvirusAnti-MalwarePro.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "XvirusAnti-MalwarePro.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "XvirusAnti-MalwarePro.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "XvirusAnti-MalwarePro.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "Xvirus Anti-Malware.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}") "Xvirus Anti-Malware.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "Xvirus Anti-Malware.exe" touched "WbemDefaultPathParser" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}") "Xvirus Anti-Malware.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "Xvirus Anti-Malware.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "Xvirus Anti-Malware.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "Xvirus Anti-Malware.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "DismHost.exe" touched "PSDispatch" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}") "DismHost.exe" touched "PSSupportErrorInfo" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{DF0B3D60-548F-101B-8E65-08002B2BD119}\TREATAS")2d:T48e,Found malicious artifacts related to "193.70.91.28": ... URL: http://cloud.xvirus.net/beta/ (AV positives: 2/83 scanned on 01/07/2021 16:05:14) URL: https://cloud.xvirus.net/ (AV positives: 1/79 scanned on 09/14/2020 09:38:51) URL: http://cloud.xvirus.net/ (AV positives: 1/79 scanned on 09/07/2020 12:44:36) URL: https://cloud.xvirus.net/download/xvirus-setup.exe (AV positives: 2/78 scanned on 08/19/2020 23:30:22) URL: https://xvirus.net/download/xvirus-firewall-setup.exe (AV positives: 4/70 scanned on 05/20/2019 19:35:08) File SHA256: c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724 (AV positives: 1/76 scanned on 12/29/2020 19:55:45) File SHA256: 8c63951b1dde04895b3119622f0972a1c8fce57a2b1b29cbf45efae04c870cf3 (Date: 08/03/2019 10:01:28) File SHA256: c0136ab89456e48bdb771018a4eb90089a32e77c158040c63fb638bfd8f51394 (AV positives: 1/73 scanned on 04/20/2019 17:54:53) File SHA256: ca6184b43cf46976d8a81aa128df1baf4ed20d4547f8ba6c1bec8f7774c1c550 (AV positives: 24/70 scanned on 02/02/2019 20:28:45) File SHA256: 8e10ed126617ef6488ea2fb9ac53e861f9cda56adf153f0e3649b51a898ac4eb (AV positives: 25/59 scanned on 09/28/2017 23:18:06)2e:Tc3d,"xam.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000088e956a76e000000180000006e000000652fe688803c00005f7b2efe71010000270000000000000020e956a76e000000a0532dfe71010000c0732efe710100001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000008ce5fe7f000069f14c0d59be0000e0468ce5fe7f0000607b2efe7101000098068de5fe7f000040812efe71010000000035e4fe7f00000000000000000000e0468ce5fe7f00000300000000000000f385e3e6fe7f00006e478ce5fe7f00002766e3e6fe7f000060e956a7 (UID: 00000000-00001716) "xam.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001716) "xam.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001716) "xam.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c93828e4fe7f000080000000000000000000000000000000304239fe710100001033e6e6fe7f0000000000000000000000006bff7101000030b956a76e000000104125e4fe7f0000508237fe71010000f0b856a76e000000000000000000000000000000000000000100000000000000b84025e4fe7f00000000000000000000010000000000000000006bff710100003b4d53e4fe7f00000000000000000000a8bd56a76e0000000000000000000000d02a7dff7101000010b3e3ff71010000e8f824e4fe7f000010b3e3ff71010000d02a7dff710100000d000000710100000d00000000000000a0f6d3ff71010000f58778ff71010000d02a7dff (UID: 00000000-00001716) "xam.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000fdb0fe7f0000e000e1e6fe7f0000405138fe71010000e03d69e5fe7f0000405138fe71010000006d73e5fe7f0000c05f38fe71010000c06d39fe71010000000000000000000000000000000000006c15e3e6fe7f0000010000000000000078a339fe710100000000e1e6fe7f00000000d2e6fe7f000000000000f8000000f800fdb0fe7f0000000069e5fe7f0000000000000000000000000000000000007ee7e3e6fe7f00000100000059be000000002dfe710100000000000000000000f8db56a76e000000000000000000000031e4e3e6fe7f00000000000000000000f800fdb0fe7f0000d8e056a76e000000d91705b1fe7f000040dc56a7 (UID: 00000000-00001716)2f:T166c,"xam.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runt73a1fc9d#\58ba49ba353b106be54fdada5c7b0154\System.Runtime.Remoting.ni.dl (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001716) "xam.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00001716)30:T427f,"xam.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter LsaLookupNames2 (UID: 00000000-00001716) "xam.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001716)31:T11bd,"xam.exe" loaded module "KERNEL32" at base e5ac0000 "xam.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base e44f0000 "xam.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base e44f0000 "xam.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base e44f0000 "xam.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base e6ba0000 "xam.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base e44f0000 "xam.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base e44f0000 "xam.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base e44f0000 "xam.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base af0e0000 "xam.exe" loaded module "ADVAPI32.DLL" at base e6d20000 "xam.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base b0b20000 "xam.exe" loaded module "SHLWAPI.DLL" at base e4cc0000 "xam.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base e3280000 "xam.exe" loaded module "VERSION.DLL" at base da5b0000 "xam.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base a4c80000 "xam.exe" loaded module "USER32.DLL" at base e5690000 "xam.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base e44f0000 "xam.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "xam.exe" loaded module "MSCOREE.DLL" at base b0bc0000 "xam.exe" loaded module "NTDLL" at base e6e10000 "xam.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base e6810000 "xam.exe" loaded module "PSAPI.DLL" at base e6be0000 "xam.exe" loaded module "KERNEL32.DLL" at base e5ac0000 "xam.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base a36c0000 "xam.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "xam.exe" loaded module "RPCRT4.DLL" at base e6bf0000 "xam.exe" loaded module "OLE32.DLL" at base e5e70000 "xam.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base e1860000 "xam.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "xam.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base e6810000 "xam.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base a2aa0000 "xam.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base a2010000 "xam.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\46C2F46666E40896049AED7E4ED25573\MICROSOFT.VISUALBASIC.NI.DLL" at base ae4c0000 "xam.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base e44f0000 "xam.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base ae2f0000 "xam.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base ae0f0000 "xam.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base a0f20000 "xam.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base adfb0000 "xam.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base a0670000 "xam.exe" loaded module "NTDLL.DLL" at base e6e10000 "xam.exe" loaded module "SHELL32.DLL" at base ff6b0000 "xam.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "xam.exe" loaded module "BCRYPT.DLL" at base e3b10000 "xam.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base e31f0000 "xam.exe" loaded module "IMM32.DLL" at base e6ba0000 "xam.exe" loaded module "COMCTL32.DLL" at base b0fd0000 "xam.exe" loaded module "GDI32.DLL" at base e58c0000 "xam.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.RUNT73A1FC9D#\58BA49BA353B106BE54FDADA5C7B0154\SYSTEM.RUNTIME.REMOTING.NI.DLL" at base adec0000 "xam.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "xam.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base add90000 "xam.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base e5ac000032:T484,"xam.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"33:Td9d,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001716-00000C28-1532035172] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001716-00000C25-2314449834] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001716-00000C25-2314532658] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001716-00000C25-2314598199] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00001716-00000C25-2314667910] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001716-00000C25-2314691316] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001716-00000C25-2314737897] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00001716-00000C25-2314805747] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00001716-00000C25-2314833008] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00001716-00000C25-2314858819] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00001716-00000C25-2314910472] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll" [Source: 00000000-00001716-00000C25-2314942484] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll" [Source: 00000000-00001716-00000C25-2314978537] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00001716-00000C25-2315115194] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00001716-00000C25-2315142877] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001716-00000C25-2315404254] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" [Source: 00000000-00001716-00000C25-2315933255] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001716-00000C25-2315980369] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001716-00000C25-2315999875] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001716-00000C25-2316021060] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll" [Source: 00000000-00001716-00000C25-2316068400]34:T620,"xam.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\OSDATA\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "xam.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: ""; Value: "")35:Tb09,"xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "xam.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "")36:T4df,"xam.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "xam.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll.aux" "xam.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.v9921e851#\46c2f46666e40896049aed7e4ed25573\microsoft.visualbasic.ni.dll.aux" "xam.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\ce0fd4f5b50baa17e7b80e4ee874ad11\system.ni.dll.aux" "xam.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\990501e6199819806f01c8ecac88baac\system.core.ni.dll.aux" "xam.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\bee998043eb1e9badecd282a79540a5e\system.windows.forms.ni.dll.aux" "xam.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\3c82a5286b5172d5a68c8df2e09c4c40\system.drawing.ni.dll.aux" "xam.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\2a25b59872a72da9b55f952ab1b0bc8b\system.configuration.ni.dll.aux" "xam.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\f0078c8c05b31633e5966c5629e65602\system.xml.ni.dll.aux"37:T55d,"xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "xam.exe" trying to access non-existent file "C:\profapi.dll" "xam.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "xam.exe" trying to access non-existent file "C:\CRYPTSP.dll" "xam.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll.DLL"38:T404,"xam.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "xam.exe" trying to access non-existent file "C:\xam.exe.config" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "xam.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\Xvirus Installer" "xam.exe" trying to access non-existent file "C:\xam.INI" "xam.exe" trying to access non-existent file "C:\xam.exe.Local\" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb" "xam.exe" trying to access non-existent file "C:\Windows\mscorlib.pdb" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb" "xam.exe" trying to access non-existent file "C:\Windows\Microsoft.VisualBasic.pdb" "xam.exe" trying to access non-existent file "C:\xam.PDB"39:T7ea,"xam.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001716) "xam.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001716) "xam.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001716) "xam.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001716) "xam.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001716) "xam.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001716) "xam.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001716) "xam.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001716) "xam.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001716) "xam.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00001716) "xam.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Xvirus Installer\* (UID: 00000000-00001716) "xam.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\* (UID: 00000000-00001716) "xam.exe" called "FindNextFileW" with parameter 46c2f46666e40896049aed7e4ed25573 (UID: 00000000-00001716) "xam.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001716) "xam.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00001716) "xam.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00001716) "xam.exe" called "FindNextFileW" with parameter 990501e6199819806f01c8ecac88baac (UID: 00000000-00001716) "xam.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00001716)3a:T484,xam.exe has PE file in resource with name: "shellfolder" and filetype: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows" xam.exe has PE file in resource with name: "VoodooAi" and filetype: "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows" xam.exe has PE file in resource with name: "Xvirus_Anti_Malware" and filetype: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows" xam.exe has PE file in resource with name: "Xvirusstart" and filetype: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows" xam.exe has PE file in resource with name: "Unin" and filetype: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows" xam.exe has PE file in resource with name: "Features" and filetype: "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows" xam.exe has PE file in resource with name: "shellfile" and filetype: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows" xam.exe has PE file in resource with name: "xvirusupdate" and filetype: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"3b:T55e,Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/5dd84fae-d113-4f08-9a74-d07fbee92d27/sample.bin at offset 68 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/5dd84fae-d113-4f08-9a74-d07fbee92d27/sample.bin at offset 36823 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/5dd84fae-d113-4f08-9a74-d07fbee92d27/sample.bin at offset 285608 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/5dd84fae-d113-4f08-9a74-d07fbee92d27/sample.bin at offset 331874 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/5dd84fae-d113-4f08-9a74-d07fbee92d27/sample.bin at offset 451766 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/5dd84fae-d113-4f08-9a74-d07fbee92d27/sample.bin at offset 1627258 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/5dd84fae-d113-4f08-9a74-d07fbee92d27/sample.bin at offset 1687807 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/5dd84fae-d113-4f08-9a74-d07fbee92d27/sample.bin at offset 1717831 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/5dd84fae-d113-4f08-9a74-d07fbee92d27/sample.bin at offset 17520883c:T6ff,"Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CABD2A79A1076A31F21D253635CB039D4329A5E8"; Key: "BLOB") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT"; Key: "") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT"; Key: "") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: "") "Xvirus Anti-Malware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")3d:T66d,"Xvirus_Anti-Malware_7.0.5.exe" called "CreateDirectoryW" with parameter C:\Program Files (x86)\Xvirus Anti-Malware (UID: 00000000-00001384) "Xvirus_Anti-Malware_7.0.5.exe" called "CreateDirectoryW" with parameter C:\Program Files (x86)\Xvirus Anti-Malware\logs (UID: 00000000-00001384) "Xvirus_Anti-Malware_7.0.5.exe" called "CreateDirectoryW" with parameter C:\Program Files (x86)\Xvirus Anti-Malware\language (UID: 00000000-00001384) "Xvirus_Anti-Malware_7.0.5.exe" called "CreateDirectoryW" with parameter C:\Program Files (x86)\Xvirus Anti-Malware\quarantine (UID: 00000000-00001384) "Xvirus_Anti-Malware_7.0.5.exe" called "CreateDirectoryW" with parameter C:\Program Files (x86)\Xvirus Anti-Malware\database (UID: 00000000-00001384) "Xvirus Anti-Malware.exe" called "CreateDirectoryW" with parameter C:\Users\ejp58Q3\AppData\Roaming\xvirusam (UID: 00000000-00005744) "Xvirus Anti-Malware.exe" called "CreateDirectoryW" with parameter C:\Program Files (x86)\Xvirus Anti-Malware\vault (UID: 00000000-00005744) "Xvirus Anti-Malware.exe" called "CreateDirectoryW" with parameter C:\Users\ejp58Q3\AppData\Local\Xvirus (UID: 00000000-00005744) "Xvirus Anti-Malware.exe" called "CreateDirectoryW" with parameter C:\Users\ejp58Q3\AppData\Local\Xvirus\Xvirus_Anti-Malware.exe_Url_niksiz0hk0xusqokokwm101tv00gdthe (UID: 00000000-00005744) "Xvirus Anti-Malware.exe" called "CreateDirectoryW" with parameter C:\Users\ejp58Q3\AppData\Local\Xvirus\Xvirus_Anti-Malware.exe_Url_niksiz0hk0xusqokokwm101tv00gdthe\7.0.5.0 (UID: 00000000-00005744) "Xvirus Anti-Malware.exe" called "CreateDirectoryW" with parameter C:\xvirus (UID: 00000000-00005744)3e:T44b3,"Y#name=Xvirus #e-mail=support@mysecuritywin.com #website=http://www.xvirus.net/ [Form1] Button8=Annuleren Button4=Aangpaste Scan Button3=Volledige Scan Button23=Snelle Scan Label7=\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\XVIRUS ANTI-MALWARE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\C0E2E1E4D71C468132BAB2CB332F3BF7B16AAA2A032E47CA88065E05FF7E2724.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\C0E2E1E4D71C468132BAB2CB332F3BF7B16AAA2A032E47CA88065E05FF7E2724.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\XVIRUS ANTI-MALWARE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\XVIRUS ANTI-MALWARE.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/40 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"xvirus.net\"\n \"cloud.xvirus.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"193.70.91.28:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"Xvirus Anti-Malware.exe\" created file \"%TEMP%\\Tmp5CB0.tmp\"\n \"Xvirus Anti-Malware.exe\" created file \"%TEMP%\\Tmp5E4C.tmp\"\n \"Xvirus Anti-Malware.exe\" created file \"%TEMP%\\Tmp5EED.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"VoodooAi.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"), Antivirus vendors marked dropped file \"Features.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"), Antivirus vendors marked dropped file \"xvirusAR.doc\" as clean (type is \"Composite Document File V2 Document Little Endian O%WINDIR%\\Version 10.0 Code page: 1252 Author: Dani Santos Template: Normal Last Saved By: Dani Santos Revision Number: 1 Name of Creating Application: Microsoft Office Word Total Editing Time: 01:00 Create Time/Date: Sun Jan 8 14:40:00 2017 Last Saved Time/Date: Sun Jan 8 14:41:00 2017 Number of Pages: 1 Number of Words: 6 Number of Characters: 35 Security: 0\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$27","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 68F50000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 6A280000\n \"Xvirus Anti-Malware.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6ACC0000\n \"Xvirus Anti-Malware.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 67DB0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"\" called \"WScript.Shell.1.CreateObject\" ... \n \"\" called \"WScript.Shell.1.CreateShortcut\" with result: \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Xvirus.lnk\" ...\n \"\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ... \n \"\" called \"WScript.Shell.1.CreateShortcut\" with result: \"C:\\Users\\x6SiIRh\\Desktop\\Xvirus.lnk\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Xvirus Anti-Malware.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Xvirus Anti-Malware.exe\" (UID: 00018419-00002596)\n Spawned process \"schtasks.exe\" with commandline \"\"SchTasks /Create /F /XML \"C:\\xvirus\\startup.xml\" /TN \"Xvirus startup\"\"\" (UID: 00018676-00002828)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"https://www.facebook.com/mikevdigitaldesigns\" (Indicator: \"facebook.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"shellfile.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"shellfolder.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"VoodooAi.dll\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Features.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"xvirusstart.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Xvirus Anti-Malware.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"xvirusupdate.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Unin.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Xvirus Anti-Malware.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.13426618879","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"F04128C52F0E5080027B5CCD607B128E\" (Indicator: \"080027\")\n \"032558D980C005056EE544B7E0CE2ACE\" (Indicator: \"005056\")","origin":"File/Memory","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Xvirus Anti-Malware.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"Xvirus_Installer.installer::loadresourcelng at ee826a11eec5f15201aa12168ab8f6b1-6000047-installer_installer_Load\n Xvirus_Installer.installer::loadresourcelng at ee826a11eec5f15201aa12168ab8f6b1-600005e-installer__Lambda___11","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"Xvirus Anti-Malware.exe\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \"Xvirus Anti-Malware.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"Xvirus Anti-Malware.exe\" called \"OpenService\" to access the \"RASMAN\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"Xvirus Anti-Malware.exe\" called \"OpenService\" to access the \"rasman\" service\n \"Xvirus Anti-Malware.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"Xvirus Anti-Malware.exe\" called \"OpenService\" to access the \"WinHttpAutoProxySvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"shellfile.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"shellfolder.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"VoodooAi.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"Features.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"xvirusstart.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"Xvirus Anti-Malware.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"xvirusupdate.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"Unin.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"cloud.xvirus.net\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"/C ping 192.0.2.2 -n 1 -w 1000 > nul&RD /S /Q \"\", \"7.0.5.0\", \"7.0.0.8\", \"7.0.2.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2b","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WinMgmts:Root\\Cimv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Xvirus Anti-Malware.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Xvirus Anti-Malware.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"Xvirus Anti-Malware.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"VoodooAi.dll\" claimed CRC 224067 while the actual is CRC 101042\n \"Features.dll\" claimed CRC 152644 while the actual is CRC 224067","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"7739ba7779a8be77be72be77d62dbe771de2b97705a2be77c868bd7757d1c477bee3b977616fbe776841bc770050bc7700000000ad3798778b2d9877b641987700000000\" to virtual address \"0x75731000\" (part of module \"WSHIP6.DLL\")\n \"\" wrote bytes \"92e6b97779a8be77be72be77d62dbe771de2b97705a2be77bee3b977616fbe776841bc770050bc7700000000ad3798778b2d9877b641987700000000\" to virtual address \"0x751E1000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"46e7b49e\" to virtual address \"0x6B312024\" (part of module \"CLR.DLL\")\n \"\" wrote bytes \"db4dfb7300000000\" to virtual address \"0x00EF2000\" (part of module \"C0E2E1E4D71C468132BAB2CB332F3BF7B16AAA2A032E47CA88065E05FF7E2724.EXE\")\n \"\" wrote bytes \"4053bc775858bd77186abd77653cbe770000000000bf8e770000000056cc8e77000000007cca8e77000000003768eb756a2cbe77d62dbe77000000002069eb750000000029a68e7700000000a48deb7500000000f70e8e7700000000\" to virtual address \"0x768F1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Xvirus Anti-Malware.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Xvirus Anti-Malware.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/64 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"21/64 Antivirus vendors marked dropped file \"shellfile.exe\" as malicious (classified as \"Adware.FakeAV\" with 32% detection rate)\n 4/64 Antivirus vendors marked dropped file \"shellfolder.exe\" as malicious (classified as \"Adware.FakeAV\" with 6% detection rate)\n 9/65 Antivirus vendors marked dropped file \"xvirusstart.exe\" as malicious (classified as \"Adware.FakeAV\" with 13% detection rate)\n 1/64 Antivirus vendors marked dropped file \"Xvirus Anti-Malware.exe\" as malicious (classified as \"Unsafe\" with 1% detection rate)\n 1/64 Antivirus vendors marked dropped file \"xvirusupdate.exe\" as malicious (classified as \"Static engine \" with 1% detection rate)\n 3/65 Antivirus vendors marked dropped file \"Unin.exe\" as malicious (classified as \"Suspicious_GEN.F47V0510\" with 4% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/64 Antivirus vendors marked spawned process \"Xvirus Anti-Malware.exe\" (PID: 2596) as malicious (classified as \"Unsafe\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"malicious","category":"Installation/Persistance","name":"Found an indicator for a scheduled task trigger","description":"\"\" (Indicator: \"LogonTrigger\"; File: \"startup.xml\")\n \"\" (Indicator: \"LogonTrigger\"; File: \"startup.xml\")","origin":"File/Memory","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 72150000","origin":"Loaded Module","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"Xvirus Anti-Malware.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"\"SchTasks /Create /F /XML \"C:\\xvirus\\startup.xml\" /TN \"Xvirus startup\"\"\" (UID: 00018676-00002828)","origin":"Monitored Target","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\Xvirus Anti-Malware\\Xvirus Anti-Malware.exe\" (Handle: 1260)\n \"\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\Xvirus Anti-Malware\\Xvirus Anti-Malware.exe\" (Handle: 1260)\n \"\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\Xvirus Anti-Malware\\Xvirus Anti-Malware.exe\" (Handle: 1260)\n \"Xvirus Anti-Malware.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\schtasks.exe\" (Handle: 1056)\n \"Xvirus Anti-Malware.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\schtasks.exe\" (Handle: 1056)\n \"Xvirus Anti-Malware.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\schtasks.exe\" (Handle: 1056)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Xvirus Anti-Malware.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll\" at 00066677-00001336-00000046-2086481\n \"Xvirus Anti-Malware.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll\" at 00066677-00001336-00000046-2090427\n \"Xvirus Anti-Malware.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll\" at 00066677-00001336-00000046-2124066\n \"Xvirus Anti-Malware.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll\" at 00066677-00001336-00000046-2129345","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2c","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Xvirus Anti-Malware.exe\" (UID: 00066677-00001336)\n Spawned process \"schtasks.exe\" with commandline \"SchTasks /Create /F /XML \"C:\\xvirus\\startup.xml\" /TN \"Xvirus sta ...\" (UID: 00067221-00001684), Spawned process \"DismHost.exe\" with commandline \"{ADF015E0-C9F4-4B9D-8F2C-9C1C404C6C74}\" (UID: 00073352-00003080)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"XvirusAnti-MalwarePro.exe\" connecting to \"\\ThemeApiPort\"\n \"Xvirus Anti-Malware.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Xvirus Anti-Malware.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Xvirus Anti-Malware.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"DismHost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"XvirusAnti-MalwarePro.exe\" at 00064848-00002660-00000033-3301035","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vboxvideo.inf\" (Indicator: \"vbox\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 193.70.91.28 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"xam.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"AsnEncodedData\" (Indicator: \"AsnEncodedData\"; File: \"xam.exe\")\n Found reference to \"SHA1Managed\" (Indicator: \"SHA1Managed\"; File: \"xam.exe\")\n Found reference to \"SHA256Managed\" (Indicator: \"SHA256Managed\"; File: \"xam.exe\")\n Found reference to \"get_Oid\" (Indicator: \"Oid\"; File: \"xam.exe\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"xam.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"xam.exe has big resource with name: \"VoodooAi\" size: \"174824\" and abnormal entropy:\"7.01445119541\"\n xam.exe has big resource with name: \"Features\" size: \"119528\" and abnormal entropy:\"6.39571093159\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"xam.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001716)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * From Win32_Process where name = 'wscript.exe'\" (Indicator: \"select * from \"; File: \"xam.exe\")\n Found string \"Select * from Win32_Process\" (Indicator: \"select * from \"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_Is64BitOperatingSystem\" in \"xam.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"xam.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to firewall policy","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile\" (Indicator: \"services\\sharedaccess\\parameters\\firewallpolicy\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.004","relevance":1,"id":"string-415","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"xam.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"Select * From Win32_Process where name = 'wscript.exe'\" (Indicator: \" Win32_Process\"; File: \"xam.exe\")\n Found string \"Select * from Win32_Process\" (Indicator: \" Win32_Process\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"xam.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * From Win32_Process where name = 'wscript.exe'\" (Source: xam.exe, Indicator: \"select * from win32_process where name = 'wscript.exe'\")\n \"Select * from Win32_Process\" (Source: xam.exe, Indicator: \"select * from win32_process\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetFileType\"; File: \"xam.exe\")\n Found reference to API (Indicator: \"DisplayVersion\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"xam.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Xvirus Anti-Malware\" in Source: xam.exe\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: xam.exe\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: xam.exe\n \"HKEY_LOCAL_MACHINE\\\" in Source: xam.exe\n \"HKEY_CLASSES_ROOT\\\" in Source: xam.exe\n \"HKEY_USERS\\\" in Source: xam.exe\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Applets\\Regedit\" in Source: xam.exe\n \"SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile\" in Source: xam.exe\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: xam.exe\n \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\" in Source: 600004f-installer~InstallButton_Click\n \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\Xvirus Anti-Malware\" in Source: 600004f-installer~InstallButton_Click","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"xam.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"xam.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"xam.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"xam.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" - [base:0; Status:c0000135]\n \"xam.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" - [base:0; Status:c0000135]\n \"xam.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"xam.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:c0000135]\n \"xam.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\VERSION.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"xam.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"WinMgmts:\" [Source: xam.exe]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"k#name=Yigido#e-mail=lugocoll4@yandex.com#website=[Form1]Button8=\" (Indicator: \"yandex.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"xam.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E4470000\n \"xam.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E3B10000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"xam.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at A4C80000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"xam.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E6BF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a0000000000204276e4fe7f0000@ntdll.dll\"\n \"2200230000000000404276e4fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"xam.exe\" was detected as \".NET\" and name: \"Library\"\n \"xam.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"xam.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"Select * From Win32_Process where name = 'wscript.exe'\" (Source: xam.exe, Indicator: \"select * from win32_process where name = 'wscript.exe'\")\n \"Select * from Win32_Process\" (Source: xam.exe, Indicator: \"select * from win32_process\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"xam.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"xam.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"xam.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"xam.exe\" has an writable section named \".sdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$32","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x2cf600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2cf404\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"xam.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"xam.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"xam.exe\" queries basic process information of the \"C:\\xam.exe\" (UID: 1716)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"xam.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"xam.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"xam.exe\" trying to touch file \"C:\\xam.exe\"\n \"xam.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"xam.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"xam.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"xam.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"xam.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"xam.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"xam.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"xam.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"xam.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"xam.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local\"\n \"xam.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Found reference to API \"u#name=Steven-Anthony Winderlich#e-mail=Secondmineboy@outlook.com#website=http://www.xvirus.net/[Form1]Button8=AbbrechenButton4=Benutzerdefinierter ScanButton3=Vollst\" (Indicator: \"@outlook.\"; File: \"xam.exe\")\n Found reference to API \"Z#name=Jaehyung Lee#e-mail=kolanp@gmail.com#website=http://www.webnest.net[Form1]Button8=\" (Indicator: \"@gmail.\"; File: \"xam.exe\")\n Found reference to API \"k#name=Yigido#e-mail=lugocoll4@yandex.com#website=[Form1]Button8=\" (Indicator: \"@yandex.\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.verisign.com\"\n Found HTTPS url \"https://d.symcb.com\"\n Found HTTPS url \"https://www.facebook.com\"\n Found HTTPS url \"https://who.is\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"xam.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"xam.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"xam.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"fe39c150\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; File: \"xam.exe\")\n Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"get_ProcessName\" in \"xam.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"get_AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; File: \"xam.exe\")\n Found reference to API \"set_AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; File: \"xam.exe\")\n Found string \"Enable password protection\" (Indicator: \"password\"; File: \"xam.exe\")\n Found string \"Wrong password!\" (Indicator: \"password\"; File: \"xam.exe\")\n Found string \"passwordset\" (Indicator: \"password\"; File: \"xam.exe\")\n Found string \"password\" (Indicator: \"password\"; File: \"xam.exe\")\n Found string \"The confirm password doesn't match with the new password.\" (Indicator: \"password\"; File: \"xam.exe\")\n Found string \"Cannot leave the password blank!\" (Indicator: \"password\"; File: \"xam.exe\")\n Found string \"Create a password\" (Indicator: \"password\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Xvirus Anti-Malware\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: xam.exe\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: xam.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * From Win32_Process where name = 'wscript.exe'\" (Indicator: \" Win32_Process\"; File: \"xam.exe\")\n Found string \"Select * from Win32_Process\" (Indicator: \" Win32_Process\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown -r -t 0\" (Indicator: \"shutdown \") in Source: xam.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcessToolStripMenuItem\" (Indicator: \"TerminateProcess\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"Found string \"regedit.exe\" (Indicator: \"regedit.exe\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"xam.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"008639fe71010000\"\n \"szProvider\": \"Microsoft Enhanced RSA and AES Cryptographic Provider\"\n \"dwProvType\": \"24\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"xam.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00001716)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * From Win32_Process where name = 'wscript.exe'\" (Indicator: \" win32_process\"; File: \"xam.exe\")\n \"Select * from Win32_Process\" (Indicator: \" win32_process\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"Found string \"SchTasks /Delete /TN \"Xvirus startup\" /F\" (Indicator: \"schtasks /delete\"; File: \"xam.exe\")\n Found string \"SchTasks /Delete /TN \\\"Xvirus startup\\\" /F\" (Indicator: \"schtasks /delete\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-629","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"/C ping 192.0.2.2 -n 1 -w 1000 > nul&RD /S /Q \"\" (Indicator: \"ping\"; File: \"xam.exe\"), Found string \"/C netstat -n -o -a\" (Indicator: \"netstat\"; File: \"xam.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains pe file in dotnet resource","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-109","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Sample/File contains another embedded binary","description":"$3b","origin":"Binary File","mitre_attack_id":"T1027","relevance":3,"id":"binary-64","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed api string:\"FromBase64String\" [Source: c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724.bin]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"Xvirus_Anti-Malware_7.0.5.exe\" queries volume information of \"C:\\\" at 00000000-00001384-00000049-9077915\n \"Xvirus_Anti-Malware_7.0.5.exe\" queries volume information of \"C:\\\" at 00000000-00001384-00000049-9522731","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"Xvirus Anti-Malware.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"A053375BFE84E8B748782C7CEE15827A6AF5A405\")\n \"Xvirus Anti-Malware.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")\n \"Xvirus Anti-Malware.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"A053375BFE84E8B748782C7CEE15827A6AF5A405\")\n \"Xvirus Anti-Malware.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"Xvirus Anti-Malware.exe\" called \"CopyFileW\" (UID: 00000000-00005744)\n \"Xvirus Anti-Malware.exe\" called \"CopyFileW\" with parameter %PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\whitelist.xdb (UID: 00000000-00005744)\n \"Xvirus Anti-Malware.exe\" called \"CopyFileW\" with parameter %PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\reglist.xdb (UID: 00000000-00005744)\n \"Xvirus Anti-Malware.exe\" called \"CopyFileW\" with parameter %PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\malvendor.xdb (UID: 00000000-00005744)\n \"Xvirus Anti-Malware.exe\" called \"CopyFileW\" with parameter %PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\heurblist.xdb (UID: 00000000-00005744)\n \"Xvirus Anti-Malware.exe\" called \"CopyFileW\" with parameter %PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\viruslist.xdb (UID: 00000000-00005744)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3d","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Xvirus Anti-Malware.exe\" called \"CreateProcessW\" with parameter \"SchTasks /Create /F /XML \"C:\\xvirus\\startup.xml\" /TN \"Xvirus startup\"\" - (UID: 00000000-00005744)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"Contains ability to download files from the internet","description":"Observed function remove_downloadfilecompleted in Xvirus Anti-Malware.exe\n Observed function add_downloadfilecompleted in Xvirus Anti-Malware.exe\n Observed function downloadfileasync in Xvirus Anti-Malware.exe\n Observed function remove_downloadfilecompleted in xvirusupdate.exe\n Observed function add_downloadfilecompleted in xvirusupdate.exe\n Observed function downloadfileasync in xvirusupdate.exe","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$3e","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cloud.xvirus.net\"\n \"xvirus.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Xvirus_Anti-Malware_7.0.5.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details","description":"Observed function get_processname in c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724.bin\n Observed function get_processname in Xvirus Anti-Malware.exe\n Observed function getprocessbyid in Xvirus Anti-Malware.exe\n Observed function get_processname in xvirusstart.exe\n Observed function get_processname in Unin.exe","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed api string:\"GetEnvironmentVariable\" [Source: c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found Native API in Dotnet file","description":"Observed function MoveFileExA in Xvirus Anti-Malware.exe\n Observed function OpenThread in Xvirus Anti-Malware.exe\n Observed function SuspendThread in Xvirus Anti-Malware.exe\n Observed function ResumeThread in Xvirus Anti-Malware.exe\n Observed function CloseHandle in Xvirus Anti-Malware.exe\n Observed function ZwTerminateProcess in Xvirus Anti-Malware.exe","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$3f","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically get system version information","description":"\"Xvirus_Anti-Malware_7.0.5.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00001384)\n \"Xvirus_Anti-Malware_7.0.5.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00001384)\n \"Xvirus_Anti-Malware_7.0.5.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00001384)\n \"Xvirus_Anti-Malware_7.0.5.exe\" called \"RtlGetVersion\" (UID: 00000000-00001384)\n \"Xvirus_Anti-Malware_7.0.5.exe\" called \"RtlGetVersion\" with parameter _ (UID: 00000000-00001384)\n \"Xvirus_Anti-Malware_7.0.5.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00001384)\n \"Xvirus_Anti-Malware_7.0.5.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00001384)\n \"Xvirus_Anti-Malware_7.0.5.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00001384)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"Xvirus Anti-Malware.exe\" (Thread ID: 6732) slept \"520\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"Xvirus_Anti-Malware_7.0.5.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"Xvirus_Anti-Malware_7.0.5.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"Xvirus_Anti-Malware_7.0.5.exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \"Xvirus_Anti-Malware_7.0.5.exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"Xvirus_Anti-Malware_7.0.5.exe\" read file \"%USERPROFILE%\\OneDrive\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$40","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Windows.Forms.Control::set_TabIndex at ee826a11eec5f15201aa12168ab8f6b1-600001f-installer~InitializeComponent\n Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet at ee826a11eec5f15201aa12168ab8f6b1-600004f-installer~InstallButton_Click","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Xvirus_Anti-Malware_7.0.5.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"Xvirus_Anti-Malware_7.0.5.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")\n \"Xvirus Anti-Malware.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":8,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Touches files in program files directory","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$43","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$44","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 135.125.200.225 on port 49730","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Xvirus Anti-Malware.exe\" (UID: 00019471-00003620) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"Xvirus Anti-Malware.exe\" (UID: 00019471-00003620) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"XvirusAnti-MalwarePro.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"XvirusAnti-MalwarePro.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"lsass.exe\"","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":180,"dropped_files_count":0,"extracted_files_count":91,"files_written_count":754,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":17,"http_requests_count":17},"behavior_tags":["evasive","ransomware","crypt","cryptinject","downloader","mofksys","neshta"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"66437f854e8c959ac5089f22","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"xam.exe","analysis_start_time":"2024-05-14T15:13:09+00:00","indicators_count":{"informative":78,"suspicious":22,"malicious":0},"tags":["Sample Crashed"],"is_in_unified_schema":true},{"id":"637681fc5b69ba2d454573f9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"suspicious.low.ml","contacted_countries":["USA"],"submit_name":"Xvirus_Anti-Malware_7.0.5.exe","analysis_start_time":"2022-11-17T19:03:18+00:00","indicators_count":{"informative":39,"suspicious":46,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5ffc2e92e390047387098d0b","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","malware_family":"Adware.Generic","contacted_countries":["FRA"],"submit_name":"Xvirus Anti-Malware Pro.exe","analysis_start_time":"2021-01-11T11:10:55+00:00","indicators_count":{"informative":19,"suspicious":18,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":false},{"id":"5ff8309cf0dd9f57157b1ac9","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":71,"malware_family":"Adware.Generic","contacted_countries":["FRA"],"submit_name":"Xvirus Anti-Malware Pro.exe","analysis_start_time":"2021-01-08T10:14:59+00:00","indicators_count":{"informative":19,"suspicious":22,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5ff82c689ed7b35e397a87e6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","malware_family":"Adware.Generic","contacted_countries":["FRA"],"submit_name":"xvirus-setup.exe","analysis_start_time":"2021-01-08T09:56:59+00:00","indicators_count":{"informative":21,"suspicious":21,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":false},{"id":"5ff813e8ec79d86b35037458","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":66,"malware_family":"Adware.Generic","contacted_countries":["FRA"],"submit_name":"Xvirus Anti-Malware Pro.exe","analysis_start_time":"2021-01-08T08:12:32+00:00","indicators_count":{"informative":20,"suspicious":23,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":false},{"id":"5cb47bda028838df2da05886","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DFI ","contacted_countries":["FRA"],"submit_name":"Xvirus Anti-Malware Pro.exe","analysis_start_time":"2019-04-15T12:31:27+00:00","indicators_count":{"informative":25,"suspicious":33,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"59c246f17ca3e15e244f53f3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware.Undefined","contacted_countries":["FRA"],"submit_name":"xvirus-setup.exe","analysis_start_time":"2017-09-20T11:44:37+00:00","indicators_count":{"informative":18,"suspicious":23,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.70.91.28","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"address":"135.125.200.225","port":49730,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]}],"dns_resolutions":[{"domain":"xvirus.net","address":"193.70.91.28","country":"France","registrar_name":"Instra Corporation Pty Ltd.","registrar_organization":"Mysecuritywin","registrar_name_servers":"NS1.ONLYDOMAINS.COM","registrar_creation_date":"2016-02-09T20:31:16+00:00","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"domain":"cloud.xvirus.net","address":"193.70.91.28","country":"France","registrar_name":"Instra Corporation Pty Ltd.","registrar_organization":"Mysecuritywin","registrar_name_servers":"NS1.ONLYDOMAINS.COM","registrar_creation_date":"2016-02-09T20:31:16+00:00","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]}],"http_requests":[{"host":"xvirus.net","host_ip":"193.70.91.28:80","url":"/download/amv.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /download/amv.txt HTTP/1.1\nHost: xvirus.net\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/maindb.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/maindb.txt HTTP/1.1\nHost: cloud.xvirus.net\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/dailydb.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/dailydb.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/heurdb.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/heurdb.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/heurdb2.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/heurdb2.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/wv.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/wv.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/dailywv.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/dailywv.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/rv.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/rv.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/vendornumber.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/vendornumber.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/compv.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/compv.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/viruslist.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/viruslist.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/heurlist2.txt","method":"GET","header":"GET /database/heurlist2.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/dailywl.txt","method":"GET","header":"GET /database/dailywl.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/dailylist.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/dailylist.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/malvendor.txt","method":"GET","header":"GET /database/malvendor.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/heurlist.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/heurlist.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"host":"cloud.xvirus.net","host_ip":"193.70.91.28:80","url":"/database/whitelist.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /database/whitelist.txt HTTP/1.1\nHost: cloud.xvirus.net","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}],"processes":[{"pid":2660,"ppid":0,"name":"XvirusAnti-MalwarePro.exe","command_line":"","sha256":"c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724","normalized_path":"C:\\XvirusAnti-MalwarePro.exe","uid":"00064848-00002660","icon":"$45"},{"pid":1336,"ppid":2660,"name":"Xvirus Anti-Malware.exe","command_line":"","sha256":"6d4d5525e6cb7626cf689698c14e9284c32ff15af23dd3ae332ccf87c2baa998","normalized_path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\Xvirus Anti-Malware.exe","parent_uid":"00064848-00002660","uid":"00066677-00001336"},{"pid":1684,"ppid":1336,"name":"schtasks.exe","command_line":"SchTasks /Create /F /XML \"C:\\xvirus\\startup.xml\" /TN \"Xvirus startup\"","sha256":"6dce7d58ebb0d705fcb4179349c441b45e160c94e43934c5ed8fa1964e2cd031","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00066677-00001336","uid":"00067221-00001684"},{"pid":3080,"ppid":0,"name":"DismHost.exe","command_line":"{ADF015E0-C9F4-4B9D-8F2C-9C1C404C6C74}","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","normalized_path":"%WINDIR%\\Temp\\B0479CB6-F2E4-499D-B4D3-D011EF3E9834\\DismHost.exe","uid":"00073352-00003080","icon":"$46"}],"all_imported_dlls":["ole32.dll","ws2_32.dll","System.Xml.ni.dll","wbemdisp.dll","CustomMarshalers.ni.dll","mscoree.dll","msvcr120_clr0400.dll","mscorlib.ni.dll","Microsoft.VisualBasic.ni.dll","System.Runtime.Remoting.ni.dll","fastprox.dll","dnsapi.dll","FWPUCLNT.DLL","shlwapi.dll","crypt32.dll","rpcss.dll","credssp.dll","bcryptprimitives.dll","msisip.dll","clr.dll","propsys.dll","devobj.dll","wininet.dll","msasn1.dll","wmiutils.dll","wintrust.dll","diasymreader.dll","RpcRtRemote.dll","apphelp.dll","imagehlp.dll","mscoreei.dll","lpk.dll","GdiPlus.dll","rtutils.dll","webio.dll","pwrshsip.dll","ntdll.dll","msctf.dll","nsi.dll","rsaenh.dll","sxs.dll","cfgmgr32.dll","cscapi.dll","VoodooAi.dll","System.Drawing.ni.dll","comctl32.dll","System.Configuration.ni.dll","iertutil.dll","CustomMarshalers.dll","version.dll","user32.dll","gdi32.dll","WSHTCPIP.DLL","setupapi.dll","wbemcomn.dll","rasman.dll","ncrypt.dll","cryptbase.dll","nlssorting.dll","clbcatq.dll","mpr.dll","dhcpcsvc6.dll","System.Windows.Forms.dll","shell32.dll","Wldap32.dll","ntshrui.dll","wbemprox.dll","rasapi32.dll","tzres.dll","rasadhlp.dll","sechost.dll","uxtheme.dll","System.Core.ni.dll","oleaut32.dll","mswsock.dll","slc.dll","IPHLPAPI.DLL","kernel32.dll","advapi32.dll","rpcrt4.dll","imm32.dll","wship6.dll","ntmarta.dll","urlmon.dll","bcrypt.dll","usp10.dll","System.ni.dll","scrrun.dll","sspicli.dll","ntdsapi.dll","dhcpcsvc.dll","taskschd.dll","clrjit.dll","cryptsp.dll","mscorrc.dll","WindowsCodecs.dll","dwmapi.dll","srvcli.dll","wbemsvc.dll","winhttp.dll","System.Windows.Forms.ni.dll","profapi.dll","linkinfo.dll","netutils.dll","winnsi.dll","psapi.dll","wshext.dll","ktmw32.dll","KernelBase.dll","msvcrt.dll","mscorlib.dll","api-ms-win-downlevel-version-l1-1-0.dll","LogProvider.dll","dbghelp.dll","SSShim.dll","DrUpdate.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wdscore.dll","OSProvider.dll","vcruntime140_clr0400.dll","SPInf.dll","ucrtbase_clr0400.dll","secur32.dll","DmiProvider.dll","VxSSL64.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","normaliz.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","devrtl.dll","DismProv.dll","api-ms-win-core-synch-l1-2-0.dll","userenv.dll","CbsCore.dll","DismCorePS.dll","drvstore.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","win32u.dll","windows.storage.dll","vcruntime140_1_clr0400.dll","SHCore.dll","ucrtbase.dll","msvcp_win.dll","combase.dll","WinTypes.dll","fltLib.dll","gdi32full.dll","kernel.appcore.dll","TextInputFramework.dll","CoreUIComponents.dll","mskeyprotect.dll","ntasn1.dll","coml2.dll","Windows.StateRepositoryPS.dll","schannel.dll","aepic.dll","microsoft_apis.dll","OpcServices.dll","OnDemandConnRouteHelper.dll","cldapi.dll","EsdSip.dll","xmllite.dll","CoreMessaging.dll","microsoft_shell_integration.dll","mip_protection_sdk.dll","winnlsres.dll","ncryptsslp.dll","AppxSip.dll","mip_core.dll","DWrite.dll","edputil.dll","mojo_core.dll","msIso.dll","powrprof.dll","Accessibility.ni.dll","xapauthenticodesip.dll","msvcr100.dll","comdlg32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Unin.exe","sha256":"7d38440f16a020109991ed39f10e230a08f1e1e8943a5abb3ab8b1f71bebcc17","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Xvirus Anti-Malware.exe","sha256":"6d4d5525e6cb7626cf689698c14e9284c32ff15af23dd3ae332ccf87c2baa998","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"shellfile.exe","sha256":"0e520551c75b61fc9b25ceb55b81d78d3a0a906491fe1a2ee8ce1b8b877d755d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"shellfolder.exe","sha256":"840c63c719009a7e5f19903b1416555e0f698345840948e7023badc691be67f2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"xvirusstart.exe","sha256":"2907720a31faf7bacfc571e60a39b32d52609c81800675cb9fec9dd5bf56fbde","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"xvirusupdate.exe","sha256":"7c7764e4dd74de9ea2ebc74b713e42a7ac3402640cf21a68467cae2e26dda291","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Features.dll","sha256":"08730788d074bad92e1795bf78e3023f67c398387c208d111ef3f273db81f86e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"VoodooAi.dll","sha256":"b2f25716aaa37fa7454a0cda7dd73be80c1eec179d94dc8cc0ee50aa56d41d58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"xvirusAR.doc","sha256":"93799737c9501a445a63dc6eed17ad714c7695f2f5d0786c20b8383f496bfa8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"adxubmz1.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"cacdtsh4.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"fqwm3isy.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"v4t21hue.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"0ws2hmhz.newcfg","sha256":"9e8c4ccd006a5e6ca9da403db36784488223beb71d0462e0a9d2ac6d6f514855","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"14ao4kdx.newcfg","sha256":"32b8f3503cd5dc6de4922ffc271a1d50dd74e9e8885704ae04708f98c08ac487","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"1soyhl5g.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"1uyn5jb2.newcfg","sha256":"a4fc6a8aa6a9259b9a3f806d577fa7af16cbef9a9e37c58ebcc506c498154c97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"4bseuzek.newcfg","sha256":"bc169589538c83b0156934a1c7b14b30e05907ff2f01c11ad21efe58731a38ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"afckmwee.newcfg","sha256":"5e9e74f44e769566cd3824215975509ea9e4edb5e9718fb1cbd9b71e59442477","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"bgzhvpvm.newcfg","sha256":"eab1a8b8af2addb8ea25ae5827396692b7660e6c0c80b8bedea0796a783d7366","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"cicew2rx.newcfg","sha256":"8f417f9cdf29aa3fb57d60d3ead2b9a2b2171854e0b750d120b9e4521d51c71b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"crvoolec.newcfg","sha256":"250cd673a1e0106b69b141f0e127885584c713807d92bf3000e239bace3c891f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"dcl3rtj3.newcfg","sha256":"191c859919c2b9cb2947aa7b83d4a33c6a3289c576bdc22b32226e9ecf498572","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"e1j3ilr0.newcfg","sha256":"9e5bcffc29c57449754ae867ae9b1e77a6c05f80cba1d068236066d406ad4d80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"gxjbpe0m.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"hvj4bmjy.newcfg","sha256":"183a120009439dcc7a0b97b284017c27330ef3c03e9ce1a444c8d3b32c28421c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"j0kb4srt.newcfg","sha256":"aa43c711fa80957b4bfd3dd2d73071eef7fd79f861b06de0aaa8712ab1e463fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"mcge32ak.newcfg","sha256":"f1031050ff6606f81013b6c9d25e97603e4114b801dc4273a14c25d75ba9eaaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"noavgufv.newcfg","sha256":"1ffcaf298a653e2d39e8cde806860cdf136ed8f99613da6bf16f8bb7d8e4a208","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"Xvirus.lnk","sha256":"62464ea76d224b07700711cbae4bd0ae35706c4abc69a6d89e45d85fc0fd5517","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"DISMHOST.EXE.5FF83E05.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"3eo02n52.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"4dcf2nsj.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"eionoxsk.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"nudbosx3.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"1qtzxsnl.newcfg","sha256":"27e07c949703f9141f4a78afbfa04a91b51d2201c51d9606f9b5d8f7820eb419","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"3tnsktlg.newcfg","sha256":"1ffcaf298a653e2d39e8cde806860cdf136ed8f99613da6bf16f8bb7d8e4a208","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"4axorqdk.newcfg","sha256":"8f417f9cdf29aa3fb57d60d3ead2b9a2b2171854e0b750d120b9e4521d51c71b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"53fewcjj.newcfg","sha256":"9645e2da8dbdd49ae5ba1de1115c6381f405b6a07cc2b85e3bbc2c1478683db3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"aogcfvvc.newcfg","sha256":"9e8c4ccd006a5e6ca9da403db36784488223beb71d0462e0a9d2ac6d6f514855","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"avj2fbe5.newcfg","sha256":"aa43c711fa80957b4bfd3dd2d73071eef7fd79f861b06de0aaa8712ab1e463fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"ccgee0aq.newcfg","sha256":"9172500c8dc7fd4401c47cc25c4140d7283109ecb1cd11f10cad3f4e8df40e92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"cd0tbg4y.newcfg","sha256":"a657f5ef9830a41cf71cf5b3f59e651215d01aad8db3104ff66a65e205758683","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"dhyqgdcv.newcfg","sha256":"183a120009439dcc7a0b97b284017c27330ef3c03e9ce1a444c8d3b32c28421c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"fqx2p4pj.newcfg","sha256":"f1031050ff6606f81013b6c9d25e97603e4114b801dc4273a14c25d75ba9eaaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"hgxuxkrw.newcfg","sha256":"a4fc6a8aa6a9259b9a3f806d577fa7af16cbef9a9e37c58ebcc506c498154c97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"hxh34eu1.newcfg","sha256":"5e9e74f44e769566cd3824215975509ea9e4edb5e9718fb1cbd9b71e59442477","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"nf2oqv4m.newcfg","sha256":"bc169589538c83b0156934a1c7b14b30e05907ff2f01c11ad21efe58731a38ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"nu0to2si.newcfg","sha256":"9e5bcffc29c57449754ae867ae9b1e77a6c05f80cba1d068236066d406ad4d80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"nvrt1ju5.newcfg","sha256":"191c859919c2b9cb2947aa7b83d4a33c6a3289c576bdc22b32226e9ecf498572","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"oeyf5yy2.newcfg","sha256":"250cd673a1e0106b69b141f0e127885584c713807d92bf3000e239bace3c891f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"5n5gfvue.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"bdcui1oe.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"czpt2532.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"j0qojdoe.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"Xvirus_Anti-Malware_7.0.5.exe.log","sha256":"8cf7f8c1a7c6fd931dc03f9309dd96e86b50f6be818c5e594578922bdb2b8d2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"0rgo4yyc.newcfg","sha256":"9e5bcffc29c57449754ae867ae9b1e77a6c05f80cba1d068236066d406ad4d80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"1k2qzumw.newcfg","sha256":"9172500c8dc7fd4401c47cc25c4140d7283109ecb1cd11f10cad3f4e8df40e92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"2jsuonvr.newcfg","sha256":"250cd673a1e0106b69b141f0e127885584c713807d92bf3000e239bace3c891f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"43ukdvtt.newcfg","sha256":"27e07c949703f9141f4a78afbfa04a91b51d2201c51d9606f9b5d8f7820eb419","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"4yktr3mu.newcfg","sha256":"aa43c711fa80957b4bfd3dd2d73071eef7fd79f861b06de0aaa8712ab1e463fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"5bbvmhws.newcfg","sha256":"191c859919c2b9cb2947aa7b83d4a33c6a3289c576bdc22b32226e9ecf498572","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"d1qegcvz.newcfg","sha256":"9e8c4ccd006a5e6ca9da403db36784488223beb71d0462e0a9d2ac6d6f514855","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"d3wdqhj3.newcfg","sha256":"eab1a8b8af2addb8ea25ae5827396692b7660e6c0c80b8bedea0796a783d7366","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"lhujyzxb.newcfg","sha256":"a4fc6a8aa6a9259b9a3f806d577fa7af16cbef9a9e37c58ebcc506c498154c97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"m20tyfxu.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"mb30eogq.newcfg","sha256":"f1031050ff6606f81013b6c9d25e97603e4114b801dc4273a14c25d75ba9eaaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"mmxilbx0.newcfg","sha256":"8f417f9cdf29aa3fb57d60d3ead2b9a2b2171854e0b750d120b9e4521d51c71b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"nturfspm.newcfg","sha256":"183a120009439dcc7a0b97b284017c27330ef3c03e9ce1a444c8d3b32c28421c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"o1woawbr.newcfg","sha256":"bc169589538c83b0156934a1c7b14b30e05907ff2f01c11ad21efe58731a38ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"oy3w5zyl.newcfg","sha256":"a657f5ef9830a41cf71cf5b3f59e651215d01aad8db3104ff66a65e205758683","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"bz40e1kc.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"ddiuluzg.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"grgkchbb.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"jdqlxpem.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"mxho4tpl.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"545yotj2.newcfg","sha256":"9e8c4ccd006a5e6ca9da403db36784488223beb71d0462e0a9d2ac6d6f514855","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"5jniccgf.newcfg","sha256":"9e5bcffc29c57449754ae867ae9b1e77a6c05f80cba1d068236066d406ad4d80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"ax0qwhli.newcfg","sha256":"bc169589538c83b0156934a1c7b14b30e05907ff2f01c11ad21efe58731a38ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"c1dsa2tw.newcfg","sha256":"1ffcaf298a653e2d39e8cde806860cdf136ed8f99613da6bf16f8bb7d8e4a208","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"dph5em0o.newcfg","sha256":"7e51786727d1d6b31a059b69b758e988d1b70eb7f5cf11d1bb1da3040823692c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"gpkr0rsr.newcfg","sha256":"eab1a8b8af2addb8ea25ae5827396692b7660e6c0c80b8bedea0796a783d7366","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"hatjsvef.newcfg","sha256":"32b8f3503cd5dc6de4922ffc271a1d50dd74e9e8885704ae04708f98c08ac487","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"inhhoqkt.newcfg","sha256":"183a120009439dcc7a0b97b284017c27330ef3c03e9ce1a444c8d3b32c28421c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"j0qh5dwk.newcfg","sha256":"9172500c8dc7fd4401c47cc25c4140d7283109ecb1cd11f10cad3f4e8df40e92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"jrdha0io.newcfg","sha256":"9645e2da8dbdd49ae5ba1de1115c6381f405b6a07cc2b85e3bbc2c1478683db3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"kt3mcljs.newcfg","sha256":"27e07c949703f9141f4a78afbfa04a91b51d2201c51d9606f9b5d8f7820eb419","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"kuw2fo0x.newcfg","sha256":"250cd673a1e0106b69b141f0e127885584c713807d92bf3000e239bace3c891f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"loqr5fcc.newcfg","sha256":"191c859919c2b9cb2947aa7b83d4a33c6a3289c576bdc22b32226e9ecf498572","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"lp1otawo.newcfg","sha256":"a657f5ef9830a41cf71cf5b3f59e651215d01aad8db3104ff66a65e205758683","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"m0obnz5h.newcfg","sha256":"aa43c711fa80957b4bfd3dd2d73071eef7fd79f861b06de0aaa8712ab1e463fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]}],"files_written":[{"path":"C:\\c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724.exe.config","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"C:\\c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MARLETT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BATANG.TTC","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COUR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COURI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COURBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COURBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\DAUNPENH.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\DOKCHAMP.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ESTRE.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\EUPHEMIA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VANI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VANIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GULIM.TTC","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\IMPACT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KALINGA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KALINGAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KARTIKA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KARTIKAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KHMERUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KHMERUIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LAOUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LAOUIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LATHA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LATHAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LUCON.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MALGUNBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MANGAL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MANGALB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MEIRYO.TTC","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MEIRYOB.TTC","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\HIMALAYA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MSJHBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MSYHBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MINGLIU.TTC","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MINGLIUB.TTC","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MONBAITI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MSGOTHIC.TTC","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTC","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MVBOLI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\NTAILU.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\NTAILUB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\NYALA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PLANTC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\RAAVI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\RAAVIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGOESC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGOESCB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGUISYM.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SHRUTI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SHRUTIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SIMSUN.TTC","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SIMSUNB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SYLFAEN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TAILE.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TAILEB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TIMES.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TIMESI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TIMESBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TIMESBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TUNGA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TUNGAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VRINDA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VRINDAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SHONAR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SHONARB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MSYI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TAHOMABD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANGSA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\APARAJ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\APARAJB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\APARAJBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\APARAJI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORDIA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\EBRIMA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\EBRIMABD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GISHA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GISHABD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KOKILA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KOKILAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KOKILABI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KOKILAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LEELAWAD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LEELAWDB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MSUIGHUR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MOOLBOR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SYMBOL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UTSAAH.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VIJAYA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VIJAYAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\WINGDING.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MODERN.FON","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ROMAN.FON","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SCRIPT.FON","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANDLSO.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARABTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SIMPO.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SIMPBDO.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SIMPFXO.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MAJALLA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MAJALLAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TRADO.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TRADBDO.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\AHRONBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\DAVID.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\DAVIDBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRANK.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LVNM.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LVNMBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MRIAM.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MRIAMC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\NRKIS.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ROD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SIMFANG.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SIMHEI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SIMKAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAU.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BROWA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BROWAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BROWAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BROWAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BROWAU.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BROWAUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BROWAUB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BROWAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAU.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCDL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCDI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCDB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCDBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCEL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCEI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCEB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCEBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCFL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCFI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCFB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCFBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCIL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCII.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCIBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCJL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCJI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCJB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCJBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCKL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCKI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCKB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCLL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCLI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCLB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\UPCLBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KAIU.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\L_10646.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARIBLK.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALIBRI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALIBRII.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIA.TTC","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CANDARA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CANDARAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CANDARAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CANDARAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COMIC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COMICBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CONSOLA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CONSTAN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CONSTANI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CONSTANB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CONSTANZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORBEL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORBELI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORBELB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CORBELZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRAMD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRAMDIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GABRIOLA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GEORGIA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PALA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PALAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PALAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PALABI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPRB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TREBUC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TREBUCIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VERDANA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VERDANAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VERDANAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VERDANAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COURE.FON","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SERIFE.FON","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SSERIFE.FON","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SMALLE.FON","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SMALLF.FON","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\OCRAEXT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PALSCRI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PAPYRUS.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PERBI___.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PERB____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PERI____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PER_____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PERTIBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PERTILI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PRISTINA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\RAGE.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ROCK.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ROCKB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ROCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ROCKI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ROCCB___.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ROCC____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ROCKEB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SCRIPTBL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TCBI____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TCB_____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TCCM____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TCCB____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TCCEB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TCMI____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TCM_____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ALGER.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BASKVILL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BAUHS93.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BELL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BELLB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BELLI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BRLNSB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BRLNSDB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BRLNSR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BERNHC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BOD_PSTC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BRITANIC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BROADW.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BRUSHSCI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALIFB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALIFI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CALIFR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CENTAUR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CHILLER.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COLONNA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\COOPBL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FTLTLT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\FREESCPT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\HARLOWSI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\HARNGTON.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\HTOWERT.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\HTOWERTI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\JOKERMAN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\JUICE___.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ITCKRIST.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\KUNSTLER.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LBRITE.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LBRITED.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LBRITEDI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LBRITEI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LCALLIG.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LFAX.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LFAXD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LFAXDI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LFAXI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LHANDW.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MAGNETOB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MATURASC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MISTRAL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MOD20.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\NIAGENG.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\NIAGSOL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\OLDENGL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ONYX.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PARCHM.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\PLAYBILL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\POORICH.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\RAVIE.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\INFROMAN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SHOWG.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SNAP____.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\STENCIL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\TEMPSITC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VINERITC.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VIVALDII.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\VLADIMIR.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\LATINWD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\CENTURY.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG2.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARIALUNI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\EQUATION\\MTEXTRA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\OUTLOOK.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\BSSYM7.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\REFSAN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\REFSPCL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\logs","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\quarantine","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\xvirusstart.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\xvirusupdate.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\Unin.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\shellfolder.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\shellfile.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\Features.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Dutch (Nederlands).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Indonesian (Bahasa Indonesia).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Estonian (Eesti).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\German (Deutsch).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Polish (polski).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Serbian (srpski).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\French (Franais).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Hungarian (magyar).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Korean (???).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Spanish (espaol).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Turkish (Trke).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Portuguese (Portugus).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\Swedish(Svenska).lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Xvirus.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Xvirus.lnk","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%USERPROFILE%\\Desktop\\Xvirus.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%USERPROFILE%\\Desktop\\Xvirus.lnk","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\system32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\Xvirus Anti-Malware.exe.config","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\b8de0f79bc74f6c423e1c719ee7afefd\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SortDefault.nlp","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\3429c09afbdb2100c619fdeda717963d\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\7152ca3b4e8d992fb4be5317321c2ee5\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\870a651e78e8d414b516df1ecae18884\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\VoodooAi.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUII.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\SEGUISB.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG3.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\WEBDINGS.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%APPDATA%\\xvirusam","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\vault","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\Xvirus Anti-Malware.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%LOCALAPPDATA%\\Xvirus","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%LOCALAPPDATA%\\Xvirus\\Xvirus_Anti-Malware.exe_Url_2ydgzcdujbwuijlvvfadl4521jhab15p","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%LOCALAPPDATA%\\Xvirus\\Xvirus_Anti-Malware.exe_Url_2ydgzcdujbwuijlvvfadl4521jhab15p\\7.0.5.0","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%USERPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"C:\\xvirus","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\system32\\en-US\\SchTasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"C:\\xvirus\\startup.xml","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\wbem\\wbemdisp.TLB","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\CustomMarshalers\\21e90cfd9060b25213757d5d09808972\\CustomMarshalers.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll.config","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\viruslist2.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\whitelist2.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\reglist2.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\complist2.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\heurblist2.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\whitelist22.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARIAL.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARIALBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARIALI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\FONTS\\ARIALBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\viruslist.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\en-US\\conhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\smss.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\System32\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\system32\\wininit.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\winlogon.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\en-US\\winlogon.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\System32\\spoolsv.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\en-US\\spoolsv.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\wbem\\wmiprvse.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\Explorer.EXE","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\taskhost.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\en-US\\taskhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\lsm.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\en-US\\lsm.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\taskeng.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\lsass.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\Dwm.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\system32\\services.exe","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\quarantinedata.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\rules.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\language\\English.lng","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\vault.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%USERPROFILE%\\Documents\\xvirusAR.doc","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%LOCALAPPDATA%\\Xvirus\\Xvirus_Anti-Malware.exe_Url_2ydgzcdujbwuijlvvfadl4521jhab15p\\7.0.5.0\\user.config","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\currentlng.dat","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%TEMP%\\vxaction.log","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\config\\SOFTWARE.LOG1","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\Tasks\\Xvirus startup","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"C:\\VxKernelSvcNT.log","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Prefetch\\CONHOST.EXE-1F3E9D7E.pf","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Prefetch\\DLLHOST.EXE-5E46FA0D.pf","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\dailylist.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\heurlist.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\whitelist.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\reglist.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\complist.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\heurblist.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\dailywl.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\database\\malvendor.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\logs\\updatelog20-9-2017-11-47-25.txt","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\System32\\config\\SYSTEM.LOG1","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\catroot2\\edb.log","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\Xvirus Anti-Malware\\localwhitelist.xdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.pdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\symbols\\dll\\Microsoft.VisualBasic.pdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\dll\\Microsoft.VisualBasic.pdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.VisualBasic.pdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\symbols\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"path":"%WINDIR%\\System32\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\Xvirus Anti-Malware.exe.config","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\Xvirus Anti-Malware.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\assembly\\pubpol201.dat","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.V9921e851#\\92c67571960b3d7f3fd30bf9d4a9bc24\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\43d86904e41b891e07c2ce8a20996e2c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\47e0be927382f169f5de470fab0ceb7d\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\38470d5ed01fd95e48dcf4e1b0b4774e\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\8089ab42d28c269586b8d72c8e01701c\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Runt73a1fc9d#\\9f55378d72425b996754ea45a6c99946\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\VoodooAi.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.23505_none_681aa442f6fed7f0\\CbsCore.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_amd64_neutral_1ade99e6e02a247f\\VBoxVideo.inf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_amd64_neutral_1ade99e6e02a247f\\vboxvideo.PNF","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\vault","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\f5db2f7c181e6f1344c9bc8dbcffce3b\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\English.lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_64\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\viruslist.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\logs\\updatelog8-1-2021-10-30-04.txt","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\xvirusstart.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\xvirusupdate.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\Unin.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\shellfolder.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\shellfile.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\Features.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Turkish (Türkçe).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Portuguese (Português).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Swedish(Svenska).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\winlogon.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\wbem\\WmiPrvSE.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\lsm.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\TEMP\\B0479CB6-F2E4-499D-B4D3-D011EF3E9834\\en-US\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\TEMP\\B0479CB6-F2E4-499D-B4D3-D011EF3E9834\\en\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\Logs\\DISM\\dism.log","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\Temp\\B0479CB6-F2E4-499D-B4D3-D011EF3E9834\\en-US\\DmiProvider.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\inf\\oem12.inf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\inf\\oem11.inf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\5d0c037297cc1a64b52ce43b45c2ac2e\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\617299d2bd5dcfe094cedface0c39d1c\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Accessibility\\dc6f17d3b5a947b693fa471cfd23bbc8\\Accessibility.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\WINGDNG3.TTF","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\webdings.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\quarantinedata.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\vault.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\localwhitelist.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%LOCALAPPDATA%\\Xvirus\\Xvirus_Anti-Malware.exe_Url_niksiz0hk0xusqokokwm101tv00gdthe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%LOCALAPPDATA%\\Xvirus\\Xvirus_Anti-Malware.exe_Url_niksiz0hk0xusqokokwm101tv00gdthe\\7.0.5.0","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\wbem\\wbemdisp.tlb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\CustomMarshalers\\db0c3f610f6405e5a18085b2c29f3a59\\CustomMarshalers.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll.config","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\rules.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\dailylist.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\heurlist.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\heurblist.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\dailywl.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\malvendor.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\whitelist.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\reglist.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database\\complist.xdb","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\dwm.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\en-US\\conhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\quarantine\\AutoIt3.exe8-1-2021-10-39-42.infected","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"C:\\XvirusAnti-MalwarePro.exe.config","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"C:\\XvirusAnti-MalwarePro.exe","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\calibri.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\calibrib.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\calibrii.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Fonts\\calibriz.ttf","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\logs","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\quarantine","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\database","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Dutch (Nederlands).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Indonesian (Bahasa Indonesia).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Estonian (Eesti).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\German (Deutsch).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Polish (polski).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Serbian (srpski).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\French (Français).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Hungarian (magyar).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Korean (한국어).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\language\\Spanish (español).lng","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"path":"%PROGRAMFILES%\\(x86)\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\Xvirus_Anti-Malware_7.0.5.exe.log","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\currentlng.dat","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\logs\\updatelog17-11-2022-11-19-32.txt","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%TEMP%\\TmpF7B.tmp","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%TEMP%\\TmpFBB.tmp","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%TEMP%\\Tmp1815.tmp","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%TEMP%\\Tmp1C00.tmp","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%TEMP%\\Tmp1D0C.tmp","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%TEMP%\\Tmp1DCA.tmp","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%TEMP%\\Tmp20ED.tmp","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%PROGRAMFILES%\\(x86)\\Xvirus Anti-Malware\\logs\\updatelog15-4-2019-2-35-49.txt","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\taskhost.exe","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\lsass.exe","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\services.exe","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\en-US\\explorer.exe.mui","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\Temp\\VxSSL64.dll","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\wbem\\Repository\\INDEX.BTR","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\wbem\\Repository\\MAPPING1.MAP","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\config\\SAM.LOG1","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\config\\SAM","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\RAC\\StateData\\RacWmiEventData.dat","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\RAC\\StateData\\RacDatabase.sdf","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\RAC\\StateData\\RacMetaData.dat","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"path":"%WINDIR%\\System32\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\XVIRUS ANTI-MALWARE\\","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\XVIRUS ANTI-MALWARE_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\XVIRUS ANTI-MALWARE_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59c246f17ca3e15e244f53f3"},{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"},{"report_type":"sandbox","report_id":"5cb47bda028838df2da05886"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5ff8309cf0dd9f57157b1ac9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1716:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"name":"Local\\SM0:1716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"name":"SM0:1716:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"66437f854e8c959ac5089f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1384:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1384:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"Local\\SM0:1384:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"Local\\SM0:1384:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5744:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"Local\\SM0:5744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"Local\\SM0:5744:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"637681fc5b69ba2d454573f9"}]}]}},"report_ids":{"sandbox_job_ids":["637681fc5b69ba2d454573f9","5cb47bda028838df2da05886","59c246f17ca3e15e244f53f3","5ff8309cf0dd9f57157b1ac9","66437f854e8c959ac5089f22"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.MSIL_Heur Sample c0e2e1e4d71c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c0e2e1e4d71c…. Malware family: Trojan.MSIL_Heur. Threat score 100/100. 2/27 AV engines flagged this file. 13 malicious and 41 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.MSIL_Heur Sample c0e2e1e4d71c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c0e2e1e4d71c…. Malware family: Trojan.MSIL_Heur. Threat score 100/100. 2/27 AV engines flagged this file. 13 malicious and 41 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c0e2e1e4d71c468132bab2cb332f3bf7b16aaa2a032e47ca88065e05ff7e2724"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.MSIL_Heur Sample c0e2e1e4d71c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c0e2e1e4d71c…. Malware family: Trojan.MSIL_Heur. Threat score 100/100. 2/27 AV engines flagged this file. 13 malicious and 41 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L47","11",{}]]