21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c3df259f21b7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c3df259f21b7…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T694,Spawned process "cmd.exe" with commandline "/c vssadmin.exe Delete Shadows /All /Quiet" (UID: 00017333-00003640) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} recoveryenabled No" (UID: 00017337-00003656) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures" (UID: 00017342-00003616) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00017351-00003636) Spawned process "bcdedit.exe" with commandline "/set {default} recoveryenabled No" (UID: 00017353-00003760) Spawned process "bcdedit.exe" with commandline "/set {default} bootstatuspolicy ignoreallfailures" (UID: 00017389-00003652) Spawned process "cmd.exe" with commandline "/c vssadmin.exe Delete Shadows /All /Quiet" (UID: 00017581-00003828) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} recoveryenabled No" (UID: 00017583-00003896) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures" (UID: 00017588-00003876) Spawned process "bcdedit.exe" with commandline "/set {default} recoveryenabled No" (UID: 00017619-00003812) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00017622-00003856) Spawned process "bcdedit.exe" with commandline "/set {default} bootstatuspolicy ignoreallfailures" (UID: 00017622-00003872) Spawned process "mshta.exe" with commandline ""%APPDATA%\HELP.hta"" (UID: 00017640-00003932) Spawned process "mshta.exe" with commandline ""%APPDATA%\HELP.hta"" (UID: 00017652-00004008) Spawned process "shutdown.exe" with commandline "-r -t 0" (UID: 00017673-00004036)23:T6cf,Spawned process "" (UID: 00014492-00003388) Spawned process "cmd.exe" with commandline "/c vssadmin.exe Delete Shadows /All /Quiet" (UID: 00017333-00003640) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} recoveryenabled No" (UID: 00017337-00003656) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures" (UID: 00017342-00003616) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00017351-00003636) Spawned process "bcdedit.exe" with commandline "/set {default} recoveryenabled No" (UID: 00017353-00003760) Spawned process "bcdedit.exe" with commandline "/set {default} bootstatuspolicy ignoreallfailures" (UID: 00017389-00003652) Spawned process "cmd.exe" with commandline "/c vssadmin.exe Delete Shadows /All /Quiet" (UID: 00017581-00003828) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} recoveryenabled No" (UID: 00017583-00003896) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures" (UID: 00017588-00003876) Spawned process "bcdedit.exe" with commandline "/set {default} recoveryenabled No" (UID: 00017619-00003812) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00017622-00003856) Spawned process "bcdedit.exe" with commandline "/set {default} bootstatuspolicy ignoreallfailures" (UID: 00017622-00003872) Spawned process "mshta.exe" with commandline ""%APPDATA%\HELP.hta"" (UID: 00017640-00003932) Spawned process "mshta.exe" with commandline ""%APPDATA%\HELP.hta"" (UID: 00017652-00004008) Spawned process "shutdown.exe" with commandline "-r -t 0" (UID: 00017673-00004036)24:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==26:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==30:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3d3dweIiIiIiIiIiIiIiIiIiIcHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh3d3d3d3d3d3d3d3d3eHB4iIiIiIiIiIiIiIiIiIhweEREREREREREREAAAAAAcHhERERERERERERIgIgIgHB4RERERERERERESICICIBweEREREREREREREREREREcHiIiIiIiIiIiIiIiIiIiHB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3d3dweIiIiIiIiIiIiIiIiIiIcHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh3d3d3d3d3d3d3d3d3eHB4iIiIiIiIiIiIiIiIiIhweEREREREREREREAAAAAAcHhERERERERERERIgIgIgHB4RERERERERERESICICIBweEREREREREREREREREREcHiIiIiIiIiIiIiIiIiIiHB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790268216996,"unified_at":"2026-09-24T16:43:36.996Z","metadata":{"hashes":{"sha256":"c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236","sha1":"f078b28cea6b95d83b5c22704490cab885a78379","md5":"e6a91b479e03c538e7111d9f8265a40b","sha512":"e1161dcf4c3d5d1d28c045eff9a866a3c3981138ee03c2c46f8831008c3b13cff83d7ac249e491c592d301e4507293d85e57078ebe5979d6f290f45af6fc8391","ssdeep":"3072:cVeAjEoTrI+ZQSpYzwo1N+gduPIlN8+vFdxfXjX:ixokmXN8+NP7X","ssdeep_chunks":["3072:cVeAjEo","3072:VeAjEoT","3072:eAjEoTr","3072:AjEoTrI","3072:jEoTrI+","3072:EoTrI+Z","3072:oTrI+ZQ","3072:TrI+ZQS","3072:rI+ZQSp","3072:I+ZQSpY","3072:+ZQSpYz","3072:ZQSpYzw","3072:QSpYzwo","3072:SpYzwo1","3072:pYzwo1N","3072:Yzwo1N+","3072:zwo1N+g","3072:wo1N+gd","3072:o1N+gdu","3072:1N+gduP","3072:N+gduPI","3072:+gduPIl","3072:gduPIlN","3072:duPIlN8","3072:uPIlN8+","3072:PIlN8+v","3072:IlN8+vF","3072:lN8+vFd","3072:N8+vFdx","3072:8+vFdxf","3072:+vFdxfX","3072:vFdxfXj","3072:FdxfXjX","6144:cVeAjEo","6144:VeAjEoT","6144:eAjEoTr","6144:AjEoTrI","6144:jEoTrI+","6144:EoTrI+Z","6144:oTrI+ZQ","6144:TrI+ZQS","6144:rI+ZQSp","6144:I+ZQSpY","6144:+ZQSpYz","6144:ZQSpYzw","6144:QSpYzwo","6144:SpYzwo1","6144:pYzwo1N","6144:Yzwo1N+","6144:zwo1N+g","6144:wo1N+gd","6144:o1N+gdu","6144:1N+gduP","6144:N+gduPI","6144:+gduPIl","6144:gduPIlN","6144:duPIlN8","6144:uPIlN8+","6144:PIlN8+v","6144:IlN8+vF","6144:lN8+vFd","6144:N8+vFdx","6144:8+vFdxf","6144:+vFdxfX","6144:vFdxfXj","6144:FdxfXjX","3072:ixokmXN","3072:xokmXN8","3072:okmXN8+","3072:kmXN8+N","3072:mXN8+NP","3072:XN8+NP7","3072:N8+NP7X"],"imphash":"9f941ca58d6585274f1ace9cc08e9139"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":117248,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1506364899000,"last_seen":1662923428000,"last_multi_scan":1662923428000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":16,"malicious_count":7,"total":33},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Gryphon","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Bitcovar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1213280","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.BTCWare.9E19F586","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ransom.GH.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.BTCWare.9E19F586 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.BTCware.H trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.BTCWare","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050b0f71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Bitcovar.cz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-BTCWare!E6A91B479E03","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Bitcovar.esvlhj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.BTCWare.S1627533","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/BTCware-C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Bitcovar.117248.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.2F064B98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.2F064B98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Backdoor.Caphaw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 59096-813-004046A3","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 59096-854-0040A0AE","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSHTA.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSHTA.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SHUTDOWN.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SHUTDOWN.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\NUCLEAR\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"NUCLEAR\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c vssadmin.exe Delete Shadows /All /Quiet\" on 2017-9-25.19:29:01.651\n \"/c bcdedit.exe /set {default} recoveryenabled No\" on 2017-9-25.19:29:01.691\n \"/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\" on 2017-9-25.19:29:01.741\n \"/c vssadmin.exe Delete Shadows /All /Quiet\" on 2017-9-25.19:29:44.144\n \"/c bcdedit.exe /set {default} recoveryenabled No\" on 2017-9-25.19:29:44.184\n \"/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\" on 2017-9-25.19:29:44.224","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$22","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"AXE8SharedExpat.dll\" has type \"COM executable for DOS\"\n \"9rNtWnjTq9RGbU.exe\" has type \"data\"\n \"Eula.exe\" has type \"data\"\n \"Adobe Reader XI.lnk\" has type \"data\"\n \"ccme_asym.dll\" has type \"COM executable for DOS\"\n \"AcroExt.exe\" has type \"data\"\n \"yZw6snqBQ28DAzu.exe\" has type \"data\"\n \"MineSweeper.lnk\" has type \"data\"\n \"BIB.dll\" has type \"COM executable for DOS\"\n \"nppdf32.dll\" has type \"COM executable for DOS\"\n \"BIBUtils.dll\" has type \"COM executable for DOS\"\n \"rRgk91Ih5n.doc\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"HELP.hta\" has type \"HTML document ASCII text with very long lines with CRLF line terminators\"\n \"ppcrlconfig.dll\" has type \"COM executable for DOS\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"icucnv40.dll\" has type \"data\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"AcroTextExtractor.exe\" has type \"COM executable for DOS\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"mshta.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \"mshta.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"mshta.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"mshta.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\"\n \"mshta.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"mshta.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"mshta.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/TR/html4/strict.dtd\"\n Pattern match: \"https://localbitcoins.com/buy_bitcoins\"\n Pattern match: \"http://www.coindesk.com/information/how-can-i-buy-bitcoins/\"\n Heuristic match: \"decyptom@cock.li\"\n Heuristic match: \"___v.co_ndesk.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"PSPUBWS.dat\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"shutdown.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"LanmanWorkstation\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"AXE8SharedExpat.dll\" has type \"COM executable for DOS\"\n \"ccme_asym.dll\" has type \"COM executable for DOS\"\n \"BIB.dll\" has type \"COM executable for DOS\"\n \"nppdf32.dll\" has type \"COM executable for DOS\"\n \"BIBUtils.dll\" has type \"COM executable for DOS\"\n \"ppcrlconfig.dll\" has type \"COM executable for DOS\"\n \"AcroTextExtractor.exe\" has type \"COM executable for DOS\"\n \"AdobeXMP.dll\" has type \"COM executable for DOS\"\n \"AcroRdIF.dll\" has type \"COM executable for DOS\"\n \"CoolType.dll\" has type \"COM executable for DOS\"\n \"AdobeCollabSync.exe\" has type \"COM executable for DOS\"\n \"AXSLE.dll\" has type \"COM executable for DOS\"\n \"javaws.exe\" has type \"COM executable for DOS\"\n \"ahclient.dll\" has type \"COM executable for DOS\"\n \"javaw.exe\" has type \"COM executable for DOS\"\n \"AiodLite.dll\" has type \"COM executable for DOS\"\n \"ccme_base.dll\" has type \"COM executable for DOS\"\n \"java.exe\" has type \"COM executable for DOS\"\n \"adoberfp.dll\" has type \"COM executable for DOS\"\n \"AcroBroker.exe\" has type \"COM executable for DOS\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"DECRYPTINFO\"; Value: \"\"%APPDATA%\\HELP.hta\"\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"HELPINFO\"; Value: \"\"%APPDATA%\\HELP.hta\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"

All your files have been encrypted!

\" (Source: HELP.hta, Indicator: \"files have been encrypted\")\n \"

All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail decryptorx@cock.li

\" (Source: HELP.hta, Indicator: \"files have been encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"payment\" (Source: screen_6.png, Indicator: \"payment\")\n \"decypt\" (Source: screen_3.png, Indicator: \"decrypt\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 663 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegOpenKeyExW\n CryptEncrypt\n GetFileAttributesA\n GetModuleHandleW\n GetModuleFileNameA\n ExitThread\n GetDriveTypeW\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n CreateThread\n FindFirstFileExA\n FindFirstFileA\n WriteFile\n FindNextFileA\n TerminateProcess\n GetModuleHandleExW\n CreateFileW\n IsDebuggerPresent\n Sleep\n GetTickCount\n CreateFileA\n ShellExecuteW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00017342-00003616)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"/set {default} bootstatuspolicy ignoreallfailures\" (UID: 00017389-00003652)\n Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00017588-00003876)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"/set {default} bootstatuspolicy ignoreallfailures\" (UID: 00017622-00003872)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/65 Antivirus vendors marked sample as malicious (69% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"45/65 Antivirus vendors marked sample as malicious (69% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"/c bcdedit.exe /set {default} recoveryenabled No\" (UID: 00017337-00003656)\n Disables startup repair \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\" (UID: 00017353-00003760)\n Disables startup repair \"cmd.exe\" with commandline \"/c bcdedit.exe /set {default} recoveryenabled No\" (UID: 00017583-00003896)\n Disables startup repair \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\" (UID: 00017619-00003812)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00017351-00003636)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00017622-00003856)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"!FILES ENCRYPTED.txt\" which has been seen in the context of ransomware (Indicator: Files encrypted.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$23","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]}],"incidents":[{"name":"Ransomware","details_count":3,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]}]},"activity":{"stats":{"process_count":16,"spawned_processes_count":16,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":17,"imported_dlls_count":77,"dropped_files_count":0,"extracted_files_count":99,"files_written_count":119,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"59c94b3d7ca3e14d930340be","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.BTCWare","submit_name":"c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236","analysis_start_time":"2017-09-25T19:28:33+00:00","indicators_count":{"informative":10,"suspicious":16,"malicious":9},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}],"processes":[{"pid":3388,"ppid":0,"name":"c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236.exe","command_line":"","sha256":"c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236","normalized_path":"C:\\c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236.exe","uid":"00014492-00003388","icon":"$24"},{"pid":3640,"ppid":3388,"name":"cmd.exe","command_line":"/c vssadmin.exe Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014492-00003388","uid":"00017333-00003640","icon":"$25"},{"pid":3636,"ppid":3640,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00017333-00003640","uid":"00017351-00003636","icon":"$26"},{"pid":3656,"ppid":3388,"name":"cmd.exe","command_line":"/c bcdedit.exe /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014492-00003388","uid":"00017337-00003656","icon":"$27"},{"pid":3760,"ppid":3656,"name":"bcdedit.exe","command_line":"/set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00017337-00003656","uid":"00017353-00003760","icon":"$28"},{"pid":3616,"ppid":3388,"name":"cmd.exe","command_line":"/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014492-00003388","uid":"00017342-00003616","icon":"$29"},{"pid":3652,"ppid":3616,"name":"bcdedit.exe","command_line":"/set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00017342-00003616","uid":"00017389-00003652","icon":"$2a"},{"pid":3828,"ppid":3388,"name":"cmd.exe","command_line":"/c vssadmin.exe Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014492-00003388","uid":"00017581-00003828","icon":"$2b"},{"pid":3856,"ppid":3828,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00017581-00003828","uid":"00017622-00003856","icon":"$2c"},{"pid":3896,"ppid":3388,"name":"cmd.exe","command_line":"/c bcdedit.exe /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014492-00003388","uid":"00017583-00003896","icon":"$2d"},{"pid":3812,"ppid":3896,"name":"bcdedit.exe","command_line":"/set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00017583-00003896","uid":"00017619-00003812","icon":"$2e"},{"pid":3876,"ppid":3388,"name":"cmd.exe","command_line":"/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014492-00003388","uid":"00017588-00003876","icon":"$2f"},{"pid":3872,"ppid":3876,"name":"bcdedit.exe","command_line":"/set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00017588-00003876","uid":"00017622-00003872","icon":"$30"},{"pid":3932,"ppid":3388,"name":"mshta.exe","command_line":"\"%APPDATA%\\HELP.hta\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00014492-00003388","uid":"00017640-00003932","icon":"$31"},{"pid":4008,"ppid":3388,"name":"mshta.exe","command_line":"\"%APPDATA%\\HELP.hta\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00014492-00003388","uid":"00017652-00004008","icon":"$32"},{"pid":4036,"ppid":3388,"name":"shutdown.exe","command_line":"-r -t 0","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\System32\\shutdown.exe","parent_uid":"00014492-00003388","uid":"00017673-00004036"}],"all_imported_dlls":["netutils.dll","pngfilt.dll","KernelBase.dll","imm32.dll","browcli.dll","vsstrace.dll","vssapi.dll","msimtf.dll","kernel32.dll","msvcrt.dll","sechost.dll","mshtml.dll","lpk.dll","mpr.dll","setupapi.dll","wkscli.dll","ieframe.dll","winbrand.dll","rpcrt4.dll","apphelp.dll","devobj.dll","psapi.dll","sxs.dll","imgutil.dll","comctl32.dll","user32.dll","shell32.dll","msasn1.dll","msctf.dll","atl.dll","advapi32.dll","cryptbase.dll","cryptsp.dll","drprov.dll","davclnt.dll","cscapi.dll","wininet.dll","cfgmgr32.dll","winsta.dll","version.dll","jscript.dll","msxml3r.dll","ntmarta.dll","profapi.dll","msimg32.dll","shlwapi.dll","IPHLPAPI.DLL","propsys.dll","oleaccrc.dll","davhlpr.dll","dwmapi.dll","msxml3.dll","nsi.dll","rsaenh.dll","ole32.dll","oleaut32.dll","iertutil.dll","sspicli.dll","ws2_32.dll","clbcatq.dll","mlang.dll","gdi32.dll","ntlanman.dll","vss_ps.dll","dnsapi.dll","winnsi.dll","secur32.dll","crypt32.dll","urlmon.dll","oleacc.dll","RpcRtRemote.dll","msls31.dll","ntdll.dll","usp10.dll","rpcss.dll","uxtheme.dll","Wldap32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"HELP.hta","sha256":"8e46f4e0a3787c899a439bc69c098fb48aa5aa01be8655e7d813df41e55932d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"directories.acrodata","sha256":"cebf4a7d6cddbc1217a2c57d352d26a28c1fe23d708ae83247bd1b8d33a1ad16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ABCPY.INI","sha256":"15f691e464bdebfcf866ff0174d58abc7e97362f8e8e995a5a69c73aad5d9271","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AcroRead.msi","sha256":"36cb9dbabe905057cc8d78a18ba26e4cde7d7dbcd1eb300873d279293732e3da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"setup.exe","sha256":"7a72d66ac4e66bb18d510bcdb04a685f3ab96c05c89c7d27913978e12be136fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Help_CValidator.H1D","sha256":"161363e00cd4270effd000c2ad351a1cb025299334b8550686219c57664d6600","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Help_MKWD_AssetId.H1W","sha256":"dabb0523a7bef2a0c9ef8a1925c91d50cace1d03de194b287aefa8fd2cda1f70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Help_MKWD_BestBet.H1W","sha256":"0bb950a4f98be007d535d7927136adca523974d57376945b11bd2238dee9de9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Help_MTOC_help.H1H","sha256":"ff377a3f6c966d72ff659541977bc9a11d6af6f6029947f48111a0accbffa562","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Help_MValidator.H1D","sha256":"1b87eddd7126088ea78d4d60dbe55a83b174e2619c74198ad165682d4cd9b9b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Help_MValidator.Lck","sha256":"46b1f18ecb4a882b0e31fae6d81cbd50acdaf53cb3c1bbe381db8e38e4eee9af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q","sha256":"e2ac5921b8aa67dee920c0b21c2d391ccaf60d417f354ba5641d41f01fde5324","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"d42cc0c3858a58db2db37658219e6400_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"934d8a581b84a1099f3b50b62f779b6f3ade93269fb194b608b1d91a26792f3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"telemetry.ASM-WindowsDefault.json.bk","sha256":"c6267b523d1c9757ca1c171439af04e26d66c73191820ef3089f07df8747f76c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"utc.app.json.bk","sha256":"681b390930e92083c68141d011b918ffc09814a9a6bba1285b5d4de21a37341e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AutoLogger-Diagtrack-Listener.etl","sha256":"9b4aa515fbd5e560ce17bf7371db8625d4bf477ace0d1c3cf75b4fcfea12d59e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ppcrlconfig.dll","sha256":"4faa54f590752b0d5b3a6ede11ee98471871f9bd431b938a380a4f09c4782323","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ppcrlui.dll","sha256":"e0e851d21f69e29400d8e62ef0ffe05abc38f800e808ff6eb6271f8233cca7ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Active.GRL","sha256":"cb9f886ee1c491a82c5e67a37f3a9d5af91f253cf028087e6525ea39c25f4ae8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Pending.GRL","sha256":"cb9f886ee1c491a82c5e67a37f3a9d5af91f253cf028087e6525ea39c25f4ae8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"dexplore.CTM","sha256":"cf6e9e1be9902f6522a11a56045aa62d12659d97dac6de491d303c94092ad876","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"autoexec.bat","sha256":"e95abfe074e123a5f0f1c3087e5f31b21dbf5975bebd70ab4c7bbb140335a9b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AXE8SharedExpat.dll","sha256":"55c48f542f3cebab41b217105d0479e6a69ea851fc9e31663fa32abe569c2df0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"38d5168b35d3cce3d068ead0c6a9869ff153b48da6be90fc8cf488bc393d7e57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Eula.exe","sha256":"b0976f70954fd7d1b4736ce269f66294027204a6ec911d544d789d922fc76c3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Adobe Reader XI.lnk","sha256":"a8b6333bb811ba8cc69041f489e5511b27a496e3fbed99d53d87fd597c59120f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ccme_asym.dll","sha256":"92d47c50735440b60406b3bca3fc21d079f000d19c3c404f5c12dd9ee4bf5a4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AcroExt.exe","sha256":"ef91fe815b18475c6b4dcb40b64e9c9509aa9f304fc75d2fe13d481be6c7d522","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"2c0fd09830fe12854e2d8f126e82aa22e2b5bfd8f3214664ac7f8816a608ed68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"MineSweeper.lnk","sha256":"3f5f7821801f10a7d05db68b3e90cef10914782c83897f36de85a7109dd4deef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"BIB.dll","sha256":"bc077830ce9a4023daae53b47b7ded34226e25df71c2674daaed606b9676449f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"nppdf32.dll","sha256":"21d0ac3840dd8460c48a0d25147b05bc092294d9dc4cc25b34997b3f1f8416ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"BIBUtils.dll","sha256":"8f1d48369eb3ccbf4dd9b72bf1f52305a09bbf602ca4fdb666afb0a9241dae68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"rRgk91Ih5n.doc","sha256":"33287fe93a2a29f293df9ca4b90cc7969f7b4db0ae11f1f6d97a765aaf98b7c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"dH1rDN9f9.doc","sha256":"e6363190f2b6c9078fc58431c6c58495ecb56a643e5f65c79a8b7bca62900442","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"6SZfLTu9z.doc","sha256":"74977ad7177e968ff7e2a76b868f6945777c17f82f672df70f068a058b878107","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"icucnv40.dll","sha256":"00db594b2f39b91b71243846d9877aca94fb87edc42a67766f1c39916446bc3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"d214d6b3b0df2d2e4f20bee4df711cfb0bc926afab4d1677a18ca74bc3e404b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AcroTextExtractor.exe","sha256":"fc9ab388ff29485786069c1cde8c1c8d6d1a3bf406ae9799eeb34609f9b60ab9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"C04T72pR0Bcl.doc","sha256":"f6ab8764911c279b4676d14cee70a205eb7b114628d41d876807c1352a8a94fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Desktop.lnk","sha256":"351912f8cf6550bcb78fe4f733ab9d80741657c001fe244431af34cc24562faf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AdobeXMP.dll","sha256":"258caefc9676aca46ba89d8e7e324be1bd873e37b2e4a4ee39f21807c3481f36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AcroRdIF.dll","sha256":"3c2b37c9bf7484b2afd7f3855ad4b76219599ab395946f13a1b75054e4f2ea4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"CoolType.dll","sha256":"1690e012196ef3673e9524fd40767c7e0f3aa7d4176c9d156422aa9a5ca610d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"w5JaoO.doc","sha256":"daada7919625ad50450ebf0c8a57695c431f09adc69b1ad250c80165473d5b99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AdobeCollabSync.exe","sha256":"c57f2a3fa120bbaf620846d4c971a516dbb6db5b8ea99b76082fde112662ba95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"8ae454312d40a17e00947f1a514a3edda4b635edc1394a1f27a2ad2393c37f5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"tDUzYwYK5f.exe","sha256":"8f0a6d283a8e8b30fa2416490e286e732002b1451225ed852cafce72ec580d32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AGM.dll","sha256":"2c945334b59c316883a2661fed7a0b680b867b00f35cbd634aa76def9f463ad0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"1d7b111bbc1de4891e32411ab121de0e3148ef34aa9c18b5756a3d898df8639e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"dskCEJ.exe","sha256":"171e49232b2f2021649919d98b88ee8a8389d6a17707572ed3190002e35d012e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"kY01UeAiy5.exe","sha256":"41c7724a90c9c68a33ed7774ca20951702f77734262341dbf98e197333c7e623","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Downloads.lnk","sha256":"02bf1fa32ab0b2b81e9954356c5448c530c690f1154a40b2e813cece997c68b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Google Chrome.lnk","sha256":"4c2b59e624626e2add720fcad2eec5df5564aa675eb7909582a65e7b8b1ec416","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"hlchPBL.exe","sha256":"7b6403ca504dc59d66bf81e6f4853d2998af7d245c7257dd9f126e24c71dd962","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"bg3oTe.doc","sha256":"5b4cd6257a122c7da8f5b8d03e8ac8380fce46ebb5bb04aa8af8c3722fd9cb7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AXSLE.dll","sha256":"3569d977d467897806eb83bc9c9af2cfa9cc428cecaa6f285957a99a9bee724e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ExtendScript.dll","sha256":"c48c3d5611507e01335a564fa27cc94b5327b1b5249a05cd12824bfce39ac125","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"javaws.exe","sha256":"d12b366d5b6d9c6eec4f53d033c598c684af4bd5606e5e54459d71825d16bb9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ahclient.dll","sha256":"fdcfd05e6429db5c9901f401b97c4acbf26012c3c78194ad96f5dde6de61494f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AcroRd32.exe","sha256":"ddeb56ea09605387394aaa37fbd1770527b56a06f2ed9bd3a81fd4ab35b2b845","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"0zIG0D.doc","sha256":"28f56f166508b2c03e1c743f3e16edf369d64d5b89056d9664ffea7629f5eeb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"javaw.exe","sha256":"390ee8dd07823ad682f80df0c2d2dc79a94ce065a3515b20cb8ecf3f1a8a0996","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ACE.dll","sha256":"3793c9e4fef572fb136c618d693fbdf81f0463237189b454047e17ef77dde843","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Windows Media Player.lnk","sha256":"60f74d412c09135ca9b32ae4797f1685d2f40ea30b3aa492804cef28538e9294","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"a3Ntx.exe","sha256":"02095adfffd8d8cace65dcfdcd1d1c9f7d17cc76f4436b8bffc65983ad17b72a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"iLLOga.exe","sha256":"ba801bbffece59e5ec00b4e50bb82ae4a4fa3b173cc5420c2b014f7c13c9ecaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AiodLite.dll","sha256":"88887d3faf69e99395c211c1fb9f8c950841c9bbb1a0e62330fd044a57089729","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ccme_base.dll","sha256":"29913d3e0bd9d56a410c1704b8a154d649441a66b13ce0fd7a7554770ce47867","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Sticky Notes.lnk","sha256":"894bdd0666b9b07287da49995b0364d14fed68cb1c42fd48fa59b614b2d42b68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Calculator.lnk","sha256":"f726cd8e57de114097de9dbce616159953c8ba2eb4eb34553e22c274583f125f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"java.exe","sha256":"11da15258360def213bf269ad52f442d4eddbf05bc9900b519e461ceb320ecc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"icudt40.dll","sha256":"a126df4914973c4a6b8a57f9ca23902d0d15cfd0cecc754956aedb4b80872ea4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"adoberfp.dll","sha256":"ff08c6e0765c7c9a087f306d6b13f01d7d6bdc361c75d950e62fb885b9c46ef2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"klmqz.doc","sha256":"b5eb7aeb6960b97d4956d3cb204c6928d0c2fb287dabf6839e9bd82aa162cead","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AcroBroker.exe","sha256":"b9761ad9db0e99d61cd5c2d24c7d4a002b9da2816475377c15f9ea6b40af68e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"mtgFs8Za.doc","sha256":"c80e01d883e40ca339f72f2f0bb0ca8e3ce38712bb12928ef7463caec04b3862","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ccme_ecc.dll","sha256":"462854ca2b7e8ca0ef8e68df27f33f5cc6b99ba8314062c51bddcd0cf7fe6b3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"A3DUtils.dll","sha256":"445fa66e9cc17cad1609ee7eec205e57b7124e399609ab6b608b709f10d0284e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"RecentPlaces.lnk","sha256":"2536918779c9957eb7d67da5863524a6745549c3d0c57f2dc24adafbd1890898","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"bvYkKJ33N9A.exe","sha256":"58fec367b0cae2ed46307d9dc78af269a153311de345a67becf13cbe046658a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"F3hzum1.doc","sha256":"d6355dc3b5f0c4375f4fc56475c59d7b70be8a11c8527fab202e38247a78ef92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"a7b24e8de6b022c6bac74d80c192b5e9bb5929c8e88438e6571b1a25ab444722","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AcroRd32Info.exe","sha256":"d74fb74b8d68bf510321437fdae0d6961dc229d902c13fe33a0bd1ffedc3a4ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ccme_ecdrbg.dll","sha256":"b24fd158e746897622e7b4846f96f837151a5d1f95c7967df3294fd633f4b85b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"hKY8.doc","sha256":"d57e03dfd8a76ac0bb5efb7606989113a183f35166a832538d57ee03373b9eb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"AdobeLinguistic.dll","sha256":"a99853dfd2474e4dbf8ffefac6cffe30de9dc123005d1a4ea1574d6b73e21cba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"ed40b67f2bd6be3c0558e697d39077a6471120b4b653a9062d46c662bb061964","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"arh.exe","sha256":"9d41f8a28722b14289463c1240975e0a75ec871897d9776f02da264fa7d1cdeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"d82c439c46f06b36f853679f3c67b3cde18f1824db51807f65dc4da1dc4aca76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"EKeaJO.doc","sha256":"d8aea1dee530fd01befacf2a5ab9a83d49fd90112d2a677cbdb2a9f22533047b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"6f7d0c11d5260794cecc4938edf7ca89283d35a6ac542d9ae6bd390478888d62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"dgQJde60mPXhI.exe","sha256":"bf082f0d54ad05d53de4ece685dff56c461d943d444bca2b1b05e5aa3e858978","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Mozilla Firefox.lnk","sha256":"5acaaff6eff4c4d12af50baa3bb90019c3b82fe14c52029c44ef189d68feb1ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Paint.lnk","sha256":"4f1d0fc5858408dd379e03f4c85f1ea4752a495e9d1c266c48a5bd1a08135279","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"cryptocme.dll","sha256":"fec7bd12153809a76fcf797c422835771ce5060c9d7e7f93b36c7c7625975008","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"ccme_base_non_fips.dll","sha256":"415f374f395b8be77e1904119ba956d28816bd384c10121fb45c4b973ba06f3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"0a88025a0a376f43e1f6a479019b66b84cee23b4e763726fc1be009254bf67c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"Acrofx32.dll","sha256":"290a7b0ac17493dfc09e90651461057780a2be4ba9be8a0701b59c190c5cba3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\Adobe\\Acrobat\\11.0\\Replicate\\Security\\directories.acrodata","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1031-7B44-AB0000000001}\\ABCPY.INI","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1031-7B44-AB0000000001}\\AcroRead.msi","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1031-7B44-AB0000000001}\\setup.exe","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1031-7B44-AB0000000001}\\Setup.ini","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\IdentityCRL\\ppcrlconfig.dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\IdentityCRL\\ppcrlui.dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\MF\\Active.GRL","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\MF\\Pending.GRL","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\MSDN\\9.0\\1033\\dexplore.CTM","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\AssetLibrary.ico","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\DATA\\89451.bpc","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\DATA\\opa12.dat","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\DocumentRepository.ico","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\MySharePoints.ico","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\MySite.ico","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\SharePointPortalSite.ico","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\SharePointTeamSite.ico","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\guest.bmp","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\%OSUSER%.dat","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\user.bmp","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\Definition Updates\\{17E6B8C1-51EE-4487-84BD-FC490F45C8B2}\\mpasdlta.vdm","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\system32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\System32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\System32\\en-US\\shutdown.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\system32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\System32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\System32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%APPDATA%\\HELP.hta","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\System32\\en-US\\mshtml.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\USERDEFINED\\","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\NUCLEAR","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"NUCLEAR","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hi5aegx!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hi5aegx!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hi5aegx!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hi5aegx!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59c94b3d7ca3e14d930340be"}]}]}},"report_ids":{"sandbox_job_ids":["59c94b3d7ca3e14d930340be"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample c3df259f21b7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c3df259f21b7…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample c3df259f21b7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c3df259f21b7…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c3df259f21b7e204855f0d6cb9a193a5340c44183b1ee6dc9519a01efc9a2236"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample c3df259f21b7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c3df259f21b7…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]