SATAN CRYPTOR

21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample dd286a4d79d0… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample dd286a4d79d0…. Malware family: Win/malicious_confidence_100%. Threat score 85/100. 22/28 AV engines flagged this file. 2 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876"],"about":{"@type":"SoftwareApplication","name":"2019-12-18.exe","applicationCategory":["peexe","executable"],"identifier":"dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T812,"" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")23:T8af,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")24:Taf4,"" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 2550528) "" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 2550528) "" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 9824001) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 9829632) "" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 9824001) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 9829633) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 9829633)25:T1348," SATAN CRYPTOR

Attention!

Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the cipher key recovery is impossible!

To decrypt your files you need to buy the special software - SATAN DECRYPTOR and your Private Decryption Key.

Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.

If you want to restore files, write us to the our e-mail: MREncptor@protonmail.com

Please write your Personal Identification Code in body of your message.

Also attach to email 3 encrypted files for free decryption test. (each file have to be less than 1 MB size and not have valuable content)

It is in your interest to respond as soon as possible to ensure the restoration of your files!

Your Personal Identification Code:

5354000000019B04000041D1F788F907F6B32BD041FA888B69CB97E23AC3B6445556E61467A3EDAA5F204D578F120D284A21573C36FEA510CF36AF824918E95D5B545A5B2C3899DD83E44529DB92EDB3A615D0B6911E83894871350C35A165417C41BE7988B02A62A16D9ED4D7A7135B93D7C2DA02A25EB4CBC3FC5B786DEA98AF434854308FD7893788E3F7656395FB071A898756D25EE4176A8EAB8AED75882F7DC1632760BE13BB40C6E96462C8A91326192A87D6B759D8A84F79E445393383018D53A45F0880288BE84AB6F2CFDA87E43E9B4A037B3B4C33E1FEE3467969A2442CEEB49B535B66B8041105D95C0D172350E2AFB841658F0D534BA4036370A9F65C306B5AB5A1F7AB6328A5A00E78E876D844F27878108BC9214B5B42A56C4856D40F4C5CE60356BE528D5C49611172C850A9143148BE135F5FBA759B9B88154D925B13E4D4C2501607B751F1A11A687746CFEB7AC04673AE8700258FB2A8D3886D56A086A807A65FDDE3957A0D59B4A85CE3D79B98FD12598564915644F999878E939DC4819FBD00DFB7B8CB54854070E39D889C25C8C5F1630A93AFEAC73D9D5DB3623D0EEFFA175707AC680790DFEB01565288BF7B5DE54289EE3F040746B770B30D5881B35910A805CA553B893FF92AD6EE6AA2C842C4838B0254C5588ACDBE6CF90B7C2E1CC4B1E467BDB5BB5409597F6C4FEFA314B1D189A9D17D4E6FAAD231E45E0E9C3E6DE7F6B52B46047822C204D4E03AAEF0A1B14B02FFFCA32EDCF14605DB37F88B09A03E9A1C1CD85CD64783C49C9953AC3EE1C8C0C333E47CE576F018B470C75545BF4A68BE31304122EFBCC5CE7034D6357D9A03C260283AA09900D44BB80596811338E1C8377D1AFA537F7470645C34753B881A5A1BE3A3182FEB45BF7A8F402E309868C7CAD5356A516F989EFE7C94C0BB12C41CB6470534C3E571779657C33358F214ABAE99FBBA1F5F1A6A9D33AF348376B44F3834011982F31A658FC173B4EE7FF8C494512A8080B83828BB651F3830AED0289531043A9741DE4751926A0F520F0747F054AB70A1F725B89E23522104C5FBE7074938DC145AC3E8841990B1987BCCD0FACBB11CBF0CCED706B8DE8CFF0AD5ADD56BE7C5868123F0B552C9B3F6FA6FCB5FFD45318B08E41DA5C2AFA7D55164479FE0698EF1821DEEBACAB12FBA99BD0352D363F74A4718E477AEAB48CBF9FB6E042858B34839223FE72C40613E37D839448C45B065E6FDC463A3B22BCA556181BB967E85543DD6E7412102E9345C956F1DBBFDA8CB4C7E792F6581443FD810DF10F0D318B46CE9EC80F0DC6642D579A5BE88C4EE8289E65685432B608A5EE9BD6BCD037A4DA5976319CB72DDB0860B88FF2B4A601739B8572DF02E117F11E096561CA2EF80C901F2E392BDD01D3D5E07E47DFDD32BA18BC7BBEDEF2FD6EE52CA36BF0BA06250D3306B578DE4BF83376BA02C37EFED58E0D51E85A6DFDA44A0FEB6880F66B0D77F403F480BF3ED80D6E9EAE29B2D036E0F8F5017CE47011CEACE168A71A102167F78777365FE1B79EBE74D7203AC90F014C328CF0CA104E366C52881EF72EC78B077546E1870BD779E7741C4A2AB7DB4F22C2C31F7B8DAF6E3DB47782D875B0D8FC2160E01341CB0B9E18F8AF97DA369FF9DEC34DCB6B50ACBFE4EC9EF2D8599579E095EC93C52F28FAD040000

" (Source: # SATAN CRYPTOR #.hta, Indicator: "decrypt your files") "Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the cipher key recovery is impossible!" (Source: # SATAN CRYPTOR #.hta, Indicator: "files have been encrypted") "To decrypt your files you need to buy the special software - SATAN DECRYPTOR and your Private Decryption Key." (Source: # SATAN CRYPTOR #.hta, Indicator: "decrypt your files")26:T9a2,"" opened "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access27:T92a,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS")28:T419,"" wrote bytes "7111fa017a3bf901ab8b02007f950200fc8c0200729602006cc805001ecdf6017d26f601" to virtual address "0x75D807E4" (part of module "USER32.DLL") "" wrote bytes "0efccf7781edce77ae86cd77c6e0cc77effdcf772d16ce77c0fccb77da8fd6776014d077478dcd77a8e2cc776089cd7700000000ad3768768b2d6876b641687600000000" to virtual address "0x747C1000" (part of module "WSHIP6.DLL") "" wrote bytes "7d07d07781edce77ae86cd77c6e0cc77effdcf772d16ce776014d077478dcd77a8e2cc776089cd7700000000ad3768768b2d6876b641687600000000" to virtual address "0x747D1000" (part of module "WSHTCPIP.DLL") "" wrote bytes "c0dfcc771cf9cb77ccf8cb770d64cd7700000000c011867500000000fc3e867500000000e0138675000000009457417625e0cc77c6e0cc7700000000bc6a407600000000cf3186750000000093194176000000002c32867500000000" to virtual address "0x761E1000" (part of module "NSI.DLL") "cmd.exe" wrote bytes "7111fa017a3bf901ab8b02007f950200fc8c0200729602006cc805001ecdf6017d26f601" to virtual address "0x75D807E4" (part of module "USER32.DLL")29:T793,Found malicious artifacts related to "149.154.167.220": ... URL: https://api.telegram.org/bot10683528:AAG5Qf70E8gdTbdLZol_J7bdKygulsm2hbQ/getMe (AV positives: 1/72 scanned on 01/05/2020 10:41:03) URL: https://api.telegram.org/bot65722602:AAGSsoMJTcxE5w0gSl-eJWnRlxrmVA4PJpo/getMe (AV positives: 2/72 scanned on 01/05/2020 10:36:04) URL: https://api.telegram.org/bot622556555:AAGn4hn0dhhkLbVrFZIjE1oudxtZ0Ir4cME/getMe (AV positives: 1/72 scanned on 01/05/2020 10:31:04) URL: https://api.telegram.org/bot699800942:AAGS_7cGzeltKLvI2w0pqk6ie5s3tO1uMZ4/getMe (AV positives: 2/72 scanned on 01/05/2020 10:26:03) URL: https://api.telegram.org/bot12512101:AAFoETPdm51F_3Z5JBbQpNTRuG66Ulo5BQA/getMe (AV positives: 2/72 scanned on 01/05/2020 10:21:03) File SHA256: b7d2f51231585c42d6b13b1f82702ccc8c6e899adfbd013393291f39e6982ddd (Date: 01/04/2020 22:22:43) File SHA256: c250de8ee435f9f44a9fae62f1c0447a144e6769315c855836b6381d40f58d4e (Date: 01/03/2020 15:30:20) File SHA256: aa5eca1e684e5445647ddc624d6262543eba6a50b9d6472e36495fa655a1b63c (Date: 01/03/2020 02:33:25) File SHA256: 89555fe7144225ee37c9120fbe6c21643e45a8779e7597ecc6868556a52ed550 (Date: 01/02/2020 19:57:57) File SHA256: b5277c77fce97adb906c41457f89575aa6cd8661921c3820795b822a436d8399 (Date: 01/02/2020 18:29:35) File SHA256: 8eba50a0c7be92835d10748854e004977ac895e4185c945b45c20a01a765a24d (AV positives: 16/72 scanned on 08/23/2019 00:28:50) File SHA256: 2109281810272fe7ecf376eba93d03ad3923e4fea201cebe7357a6495a4f0786 (AV positives: 3/72 scanned on 07/31/2019 18:50:56) File SHA256: 3608d7274ece6ea50a86fe59b5437bb519f216b02c759281a0031d4b231996bb (AV positives: 20/70 scanned on 07/23/2019 13:08:54) File SHA256: 6b3debb3e9e04cead3e7db8116695c4c19395758c99972080438fee9359e9681 (AV positives: 1/72 scanned on 06/27/2019 05:50:27) File SHA256: 8f80de6f56451cd3eeca709900984c7a01a1203768241ce4c0d3944fae2d0ae5 (AV positives: 4/65 scanned on 06/17/2019 10:11:08)2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790266819906,"unified_at":"2026-09-24T16:20:19.906Z","metadata":{"hashes":{"sha256":"dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876","sha1":"a57592be641738c86c85308ef68148181249bc0b","md5":"057aad993a3ef50f6b3ca2db37cb928a","sha512":"87c89027d60f80e99c526584fa093620b3f099151170362424ad78f5e4d7184bd9f2d627ec8463ca202127835f435dd4f85bf2b0d9351593c688855f0bbaffbb","ssdeep":"49152:BY/3BNLViG5jQWArXncSxhBfV7xLE1t+XgWJz5qtAj6R:BwgG5MWMX7h8+Uw","ssdeep_chunks":["49152:BY/3BNL","49152:Y/3BNLV","49152:/3BNLVi","49152:3BNLViG","49152:BNLViG5","49152:NLViG5j","49152:LViG5jQ","49152:ViG5jQW","49152:iG5jQWA","49152:G5jQWAr","49152:5jQWArX","49152:jQWArXn","49152:QWArXnc","49152:WArXncS","49152:ArXncSx","49152:rXncSxh","49152:XncSxhB","49152:ncSxhBf","49152:cSxhBfV","49152:SxhBfV7","49152:xhBfV7x","49152:hBfV7xL","49152:BfV7xLE","49152:fV7xLE1","49152:V7xLE1t","49152:7xLE1t+","49152:xLE1t+X","49152:LE1t+Xg","49152:E1t+XgW","49152:1t+XgWJ","49152:t+XgWJz","49152:+XgWJz5","49152:XgWJz5q","49152:gWJz5qt","49152:WJz5qtA","49152:Jz5qtAj","49152:z5qtAj6","49152:5qtAj6R","98304:BY/3BNL","98304:Y/3BNLV","98304:/3BNLVi","98304:3BNLViG","98304:BNLViG5","98304:NLViG5j","98304:LViG5jQ","98304:ViG5jQW","98304:iG5jQWA","98304:G5jQWAr","98304:5jQWArX","98304:jQWArXn","98304:QWArXnc","98304:WArXncS","98304:ArXncSx","98304:rXncSxh","98304:XncSxhB","98304:ncSxhBf","98304:cSxhBfV","98304:SxhBfV7","98304:xhBfV7x","98304:hBfV7xL","98304:BfV7xLE","98304:fV7xLE1","98304:V7xLE1t","98304:7xLE1t+","98304:xLE1t+X","98304:LE1t+Xg","98304:E1t+XgW","98304:1t+XgWJ","98304:t+XgWJz","98304:+XgWJz5","98304:XgWJz5q","98304:gWJz5qt","98304:WJz5qtA","98304:Jz5qtAj","98304:z5qtAj6","98304:5qtAj6R","49152:BwgG5MW","49152:wgG5MWM","49152:gG5MWMX","49152:G5MWMX7","49152:5MWMX7h","49152:MWMX7h8","49152:WMX7h8+","49152:MX7h8+U","49152:X7h8+Uw"],"imphash":"406f4cbdf82bde91761650ca44a3831a"},"file_info":{"file_name":"2019-12-18.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1883136,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1578230015000,"last_seen":1677910915000,"last_multi_scan":1677910915000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["eris","filecoder","ransomware"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":17,"suspicious_count":20,"malicious_count":2,"total":39},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypmod.tr1O","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SatanCryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Crypmod","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1211844","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.SatanCrypt.C7F35B64","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Ransom.SDSR-1396","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.SatanCrypt.C7F35B64 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.NYZ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!B1CDFF0234068B07","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e5941 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Crypmod.adey","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.gsjxxg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.6FB96606","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.6FB96606","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Crypmod","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.11840","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"malicious","value":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\Documents and Settings\" at 00036371-00003140-00000046-11009056622\n \"\" queries volume information of \"%ALLUSERSPROFILE%\\Application Data\" at 00036371-00003140-00000046-12446579438\n \"\" queries volume information of \"%ALLUSERSPROFILE%\\Desktop\" at 00036371-00003140-00000046-12448093518\n \"\" queries volume information of \"%ALLUSERSPROFILE%\\Documents\" at 00036371-00003140-00000046-12450881668\n \"\" queries volume information of \"%ALLUSERSPROFILE%\\Favorites\" at 00036371-00003140-00000046-12452218420","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$22","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$23","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"extreme-ip-lookup.com\"\n \"api.telegram.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.220:443\"\n \"104.238.220.224:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%WINDIR%\\Temp\\satan\\satan0\"\n \"\" created file \"%WINDIR%\\Temp\\satan\\satan1\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /json/ HTTP/1.1\nHost: extreme-ip-lookup.com\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c ver\" on 2020-1-5.13:14:23.502\n \"%WINDIR%\\system32\\cmd.exe /C del C:\\2019-12-18.exe\" on 2020-1-5.13:15:54.994","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c ver\" (UID: 00036717-00003148)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /C del C:\\2019-12-18.exe\" (UID: 00040016-00002756)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c ver\" (UID: 00036717-00003148)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /C del C:\\2019-12-18.exe\" (UID: 00040016-00002756)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"# SATAN CRYPTOR #.hta\" has type \"HTML document ASCII text with very long lines with CRLF line terminators\"\n \"603jOLdO.exe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\WSHTCPIP.DLL\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\wship6.dll\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\wshqos.dll\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Temp\\satan\\\"\n \"\" touched file \"%WINDIR%\\Temp\\satan\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\cmd.com\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\Temp\\satan\\satan0\"\n \"\" touched file \"%WINDIR%\\Temp\\satan\\satan1\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\tzres.dll\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\cmd.exe\"\n \"cmd.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ovOctPC=P.PK\"\n Heuristic match: \"extreme-ip-lookup.com\"\n Heuristic match: \"api.telegram.org\"\n Heuristic match: \">M.Sn\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2019-12-18.exe.bin\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00036371-00003140-00000033-4384444150","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.91371428735","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"2019-12-18.exe.bin\" has a section named \"UPX0\"\n \"2019-12-18.exe.bin\" has a section named \"UPX1\"\n \"2019-12-18.exe.bin\" has a section named \"UPX2\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"HAPUBWS.contact\" containing the Windows username \"HAPUBWS\"\n Found dropped filename \"HAPUBWS-PC-20171204-1725.log\" containing the Windows username \"HAPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/72 reputation engines marked \"http://api.telegram.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%ALLUSERSPROFILE%\\Adobe\\ARM\\ArmReport.ini\"\n \"\" read file \"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini\"\n \"\" read file \"%ALLUSERSPROFILE%\\KMSAutoS\\kmsauto.ini\"\n \"\" read file \"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$24","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.220 on port 443 is sent without HTTP header\n TCP traffic to 104.238.220.224 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$25","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"api.telegram.org\" (Indicator: \"telegram.org\"; File: \"PCAP\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"2019-12-18.exe.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"2019-12-18.exe.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"\" touched \"O:\\\"\n \"\" touched \"P:\\\"\n \"\" touched \"Q:\\\"\n \"\" touched \"R:\\\"\n \"\" touched \"S:\\\"\n \"\" touched \"T:\\\"\n \"\" touched \"U:\\\"\n \"\" touched \"V:\\\"\n \"\" touched \"W:\\\"\n \"\" touched \"X:\\\"\n \"\" touched \"Y:\\\"\n \"\" touched \"K:\\\"\n \"\" touched \"L:\\\"\n \"\" touched \"M:\\\"\n \"\" touched \"N:\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":43,"dropped_files_count":0,"extracted_files_count":58,"files_written_count":152,"files_deleted_count":0,"registry_keys_created_count":23,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":23,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["eris","filecoder","ransomware"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5e11e0fa86382114b91615d4","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["GBR","USA"],"submit_name":"2019-12-18.exe","analysis_start_time":"2020-01-05T13:13:46+00:00","indicators_count":{"informative":17,"suspicious":23,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.220","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"address":"104.238.220.224","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]}],"dns_resolutions":[{"domain":"api.telegram.org","address":"149.154.167.220","ttl":183,"country":"United Kingdom","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS-CLOUD-B1.GOOGLEDOMAINS.COM","registrar_creation_date":"2003-12-15T14:48:05+00:00","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"domain":"extreme-ip-lookup.com","address":"104.238.220.224","ttl":17,"country":"United States","registrar_name":"Amazon Registrar, Inc.","registrar_organization":"Whois Privacy Service","registrar_creation_date":"2016-06-24T12:03:47+00:00","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]}],"http_requests":[{"host":"extreme-ip-lookup.com","host_ip":"104.238.220.224:80","url":"/json/","method":"GET","header":"GET /json/ HTTP/1.1\nHost: extreme-ip-lookup.com\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}],"processes":[{"pid":3140,"ppid":0,"name":"2019-12-18.exe","command_line":"","sha256":"dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876","normalized_path":"C:\\2019-12-18.exe","uid":"00036371-00003140","icon":"$2a"},{"pid":3148,"ppid":3140,"name":"cmd.exe","command_line":"cmd /c ver","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00036371-00003140","uid":"00036717-00003148"},{"pid":2756,"ppid":3140,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /C del C:\\2019-12-18.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00036371-00003140","uid":"00040016-00002756"}],"all_imported_dlls":["lpk.dll","sechost.dll","sspicli.dll","tzres.dll","ntdll.dll","wow64win.dll","wow64cpu.dll","imm32.dll","msctf.dll","wshqos.dll","WSHTCPIP.DLL","FWPUCLNT.DLL","usp10.dll","mswsock.dll","userenv.dll","apphelp.dll","winmm.dll","gdi32.dll","cryptsp.dll","profapi.dll","ncrypt.dll","user32.dll","cryptbase.dll","gpapi.dll","bcrypt.dll","bcryptprimitives.dll","KernelBase.dll","msvcrt.dll","IPHLPAPI.DLL","rasadhlp.dll","winbrand.dll","msasn1.dll","advapi32.dll","nsi.dll","rsaenh.dll","crypt32.dll","kernel32.dll","rpcrt4.dll","ws2_32.dll","wship6.dll","dnsapi.dll","winnsi.dll","wow64.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"# SATAN CRYPTOR #.hta","sha256":"33076ec7b527bdc665671eec22571a0eaa3ae7223e224b8e766a9d5934a32706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"ArmReport.ini","sha256":"a019235f540d221ebe75b685b1584458a9438db74b5d9b3cd8dcc6801c3e3632","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"AcroRead.msi","sha256":"188d1366edbab34db99358bb8e448f0f35090d3aa22845415e4cec93e49c5db2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"abcpy.ini","sha256":"dbd9eb94233308520dd36371c34078e4f4cd5c7c3825cc4c6df25666c90b32e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"devcon.exe","sha256":"ca9f2b356d61b0993c3797dc5d725e169e10b2b0b128a020c8695bffe1781cd9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"FakeClient.exe","sha256":"1b16782c403e63198b61ef68f6e2efc380bc8ff9e66b5204f6f5ac6cf6cb3be0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Help_CValidator.H1D","sha256":"74294783e9be98d1194ab3e9cffa889df0f15a6b70e782bdde38bc146e125791","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Help_MKWD_AssetId.H1W","sha256":"94209c5182059b6de4eb541fa572cfb7df6e1fbe619561bfffa73728d78b666f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Help_MKWD_BestBet.H1W","sha256":"c84b469ce53bdef5aef79a75cb42a60038c7a3cd103c5e5721300e07148116cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Help_MTOC_help.H1H","sha256":"9df8d25595b8a8c06df1908cb9a3d5c3977a7c1f465ac33ae060e0c86deeec58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Help_MValidator.H1D","sha256":"9a4fe41d9a9a5ecfe461c99656bf50a29cd722144a387cb0c863aa346042e053","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Help_MValidator.Lck","sha256":"a2ccf35ff6151660df055a6e36f29460074b846dd43aa6517888aebf6f7bf181","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"DeploymentConfig.0.xml","sha256":"7d85be2bcd1cddbd98248b13cae9014d8f6f3876b0c8314054383db578d8c76d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"DeploymentConfig.1.xml","sha256":"b5276f0e04cf29d203125e469e9e0e7626fc90f557a6bc9fb6cef9dd89cc0794","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"DeploymentConfig.2.xml","sha256":"25bd24f7edc34482a1f27a816faa3ed0717dca509da452416b4e510e75df5ded","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"ExcelMUI.msi","sha256":"9dc61bba466961386b6759048dd7109ea37a63fb47633ef02695f05ea5634a25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"ExcelMUI.xml","sha256":"b2c79ab30b4380467d0eea4314164c34ae66d7562ac9d31724204eabab7de5f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"dwintl20.dll","sha256":"aa18ddf47133775439151759780ec2c639ae974a82bf4100a6a8d22f5e24763b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"DW20.EXE","sha256":"161dd39eeeeaf7e9f618e12dafb7c67c5b2561882756d9d7d05a1da6928a836c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"branding.xml","sha256":"e5d704bf45dbef4dbd7ba3bb7a229ba2dce85da1d5fd30e899bc8e80b2284d9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"dwdcw20.dll","sha256":"65dedd2f45920217cb8d252d7530e7016a02b037580b0c7c59c23a0b1db613df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"dwtrig20.exe","sha256":"ac660c00bd7cda487489ce9e2bc4d08a9b9c12ee5d475b76f953d7217fed627c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"603jOLdO.exe","sha256":"1c3f9ff6a50005c37c66cc405fc10c26fd0a17b88131ebd7f6984ec138b17d9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"CZspj.doc","sha256":"5b675e9b5e9371179f5cbad24337aedfc84c33aa6492638506b0689615317283","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"5F7TBCLUxJG.doc","sha256":"63b5f94774ec1dbc8978495107e444aa4486dc7b753c9c6f2e7db376f4eafc88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"airappinstaller.exe","sha256":"d6627ef0dc5bffffe5cad8b29b8a4f542d3b3c9d94991dec75b4ee2fa5337ecb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Desktop.lnk","sha256":"65cd2fa95aba4310e1e442569c31eed1de4664348fddc6e84970269f79d3411a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"ETWlog.dll","sha256":"7251b9aad652dd6d4413080f082fb2655b3bdbcfb1f0d12813c42b9a020de794","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"3LnBJn.doc","sha256":"659f3b91e104686a0d491fa9cd1a76fd0a62d6c742d9f59769b45dbd8c06399f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"FileSyncApi64.dll","sha256":"97fc7c19116e42c97c8619767375a735a7d2e4e7626350bc10fbe9f949676158","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"bMTL7.doc","sha256":"a1438fc294577ac5da34cf51d00c60aba1a09665807fca8af392e8bdf8ec7329","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"4RHcGmkB.exe","sha256":"4844cc11941ff387d2ed426391ad5e743472e2f04dce44c0b93a3c7f4d05adeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"FileSyncSessions.dll","sha256":"a286a9a704c77c30b524e0c5a2f082e9dfdf590569e3dcd7a81fe65daa92ea1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"2VEV49vrsTLgZa.doc","sha256":"1ce5c45dd0647ac6a3101ee0233888787a9aaf7f13ac8deab55a8b8335a3476a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"gtcmotdmF.doc","sha256":"cdf75f5c1deb2e89af9b3a9009ef20594e508172eae489791d56b30ad906c09e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"FileSyncApi.dll","sha256":"ffa09a4b7b22c436dc94d59aeca6d690f91c0421b5975dd32d740541b6f6f1ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"FileSyncConfig.exe","sha256":"fdbab2246f0b8d105568d928671042e9fbecbf2adb3864dfe64ba7db88b040c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Database1.LNK","sha256":"1f8614d16292fe348eeeaccf4fa7b006adbe99d4a79fc921b8561b2ee4f8696d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"2f07Jm4brrx.exe","sha256":"9d626d21264df68c6f288278f9659f78232a4b92ea8ba2fb7b9c42e93cc8d257","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"8L418Npib.exe","sha256":"7952282fa699046333d4c648aa6de42b0c855bd1c62d94c33be2eee91c748820","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"CollectOneDriveLogs.bat","sha256":"d6b983f8e9934005d39949e297216078068af0b01da4cf382492618abcf0c7f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"FileSync.LocalizedResources.dll","sha256":"78d51a661aa6c9b7f29502c704565b462ad61fb263f28df89b36e8a1e406dcb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"FileSyncClient.dll","sha256":"1cedb745e89dddc1192367c8fb0a3a94be2befe3ef71c43d4d3e28fff1453517","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Ae5I9Tp.doc","sha256":"47abb0b2793f7daedc2807ff4736c74dae5e5829c4625e3651822b85970f16f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"GgHlzQR.doc","sha256":"199ca9135fcac8f32ba7ea6ad90642461bc155e4e0b2b1ecdae920fe008b1281","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"F42upSs.exe","sha256":"07ceb64b78d003b6a15f2b8c56e89e1c6cef0076f3498e00feb418712eca1b10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"FileSync.Resources.dll","sha256":"c91b8a56f86cc64b52ed96719bc68a4bf5914486b739026445521da99bfa879d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"7mOyQqezSRsEQhHm.exe","sha256":"73f4df293655e269332389c77481167075427b79d54e2c6bfffc557c7ed29f5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"cQTUR.exe","sha256":"b0b76e0b31f6cbcd36a5cacfb87da7117b03672cf1fd5967656edbb9540c41f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Downloads.lnk","sha256":"6ea93931f0085dd105b0276e96ba40b484224fb895e63fd76d73371bd70b4480","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"HoJQ.doc","sha256":"2a3a56cd085a13587d2e09e1ab44b3d75a498d07f778317d143282d0231e3690","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"07c4.exe","sha256":"0a68e2eb07ba40993f50ad5d35467958a57b7c1fbfc235b052fff16c517ce6bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Czkv.exe","sha256":"199c42143e6aef8402b5cddfcb261ebddba3cb9c9f461e8325db4b4174334a60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"GmpsrAn.exe","sha256":"34e0ad38df726ef2f373c13cc75dfbdfac51c91e048de2a14edf36049bc2a165","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"DKwpgw.doc","sha256":"cb4359d36c7560c640cc6f7dcbc413e23275f34c86102c89432aec7eb651c766","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"eVGu5yCg91A9.exe","sha256":"9da90b61050559dca65ade5c5ea042effcaa1741d0e245db4f43efc88145519f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Acrobat Reader DC.lnk","sha256":"8cb9ab520fc562ee3f33c5473fca18f53e4ae5bd0327bae47cca51aff460cd43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"name":"Built-In Building Blocks.dotx","sha256":"72cb166a97ed3d99eaabcebde3716e4c6a37de9812a68b88d46b6ab280850110","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\SysWOW64\\WSHTCPIP.DLL","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\Temp\\satan","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\Z\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%SAMPLEDIR%\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\share\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\share\\1578230039146$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.com","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.bat","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.cmd","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.vbs","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.vbe","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.js","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.jse","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.wsf","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.wsh","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\cmd.msc","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.com","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.bat","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.cmd","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.vbs","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.vbe","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.js","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.jse","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.wsf","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.wsh","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\cmd.msc","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.com","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\2019-12-18.exe","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\AIR\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\AIR\\Updater","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\AIR\\Updater\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\Reader_18.009.20050","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\Reader_18.009.20050\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\bin\\driver","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\bin\\driver\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\bin\\driver\\x64TAP1","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\bin\\driver\\x64TAP1\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\bin\\driver\\x64WDV","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\bin\\driver\\x64WDV\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0\\en-US","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Assistance\\Client\\1.0\\en-US\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\B8D90C25-53BA-46F1-9F8A-D2A51B970758\\x-none.16","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\B8D90C25-53BA-46F1-9F8A-D2A51B970758\\x-none.16\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\FEB6C393-6D33-4DBF-B4B7-E04E1259ECFF","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\FEB6C393-6D33-4DBF-B4B7-E04E1259ECFF\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\FEB6C393-6D33-4DBF-B4B7-E04E1259ECFF\\en-us.16","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\FEB6C393-6D33-4DBF-B4B7-E04E1259ECFF\\en-us.16\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\FEB6C393-6D33-4DBF-B4B7-E04E1259ECFF\\x-none.16","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\FEB6C393-6D33-4DBF-B4B7-E04E1259ECFF\\x-none.16\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\MachineData","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\MachineData\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\MachineData\\Catalog","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\MachineData\\Catalog\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\MachineData\\Integration","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\MachineData\\Integration\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\FEB6C393-6D33-4DBF-B4B7-E04E1259ECFF\\x-none.16\\stream.x86.x-none.man.dat","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\Temp\\satan\\satan0","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\Temp\\satan\\satan1","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\share.txt","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\share\\1578230039146$OK","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\share\\2019-12-18.exe","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\$Recycle.Bin","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\Documents and Settings","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\PerfLogs","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\PerfLogs\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\PerfLogs\\Admin","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\PerfLogs\\Admin\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\AIR","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Application Data","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\bin","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\bin\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\bin\\driver\\x64TAP2","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\KMSAutoS\\bin\\driver\\x64TAP2\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\B8D90C25-53BA-46F1-9F8A-D2A51B970758","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\B8D90C25-53BA-46F1-9F8A-D2A51B970758\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\B8D90C25-53BA-46F1-9F8A-D2A51B970758\\en-us.16","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\B8D90C25-53BA-46F1-9F8A-D2A51B970758\\en-us.16\\# SATAN CRYPTOR #.hta","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5e11e0fa86382114b91615d4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5e11e0fa86382114b91615d4"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample dd286a4d79d0… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample dd286a4d79d0…. Malware family: Win/malicious_confidence_100%. Threat score 85/100. 22/28 AV engines flagged this file. 2 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample dd286a4d79d0… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample dd286a4d79d0…. Malware family: Win/malicious_confidence_100%. Threat score 85/100. 22/28 AV engines flagged this file. 2 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample dd286a4d79d0… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample dd286a4d79d0…. Malware family: Win/malicious_confidence_100%. Threat score 85/100. 22/28 AV engines flagged this file. 2 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]