zdf

21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 25:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample e2209f339b2e… — Score 77/100 — Hybrid Analysis","description":"Malicious verdict for sample e2209f339b2e…. Malware family: Win/malicious_confidence_100%. Threat score 77/100. 1/1 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2"],"about":{"@type":"SoftwareApplication","name":"UYTd46732","applicationCategory":["peexe","executable"],"identifier":"e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2","additionalType":"Malicious sample"},"threatScore":77,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":1,"total":1},"behavioralIndicators":{"malicious":5,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T11a9," zdf

Your files are Encrypted!

For data recovery needs decryptor.

If you want to buy a decryptor click "Buy Decryptor"

If not working, click again.

Free decryption as guarantee.
Before paying you can send us 1 file for free decryption.
To send a message or file use this link.
Support

If you can not contact, follow these two steps:
1. Install the TOP Browser from this link: torproject.org
2. Open this link in the TOP browser: http://n224ezvhg4sgyamb.onion/sup.php

" (Source: Read___ME.html, Indicator: "files are encrypted") "

Your files are Encrypted!

" (Source: Read___ME.html, Indicator: "files are encrypted")23:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAd3d3d3d3d3d3d3d3cAAAAHd3d3d3d3d3d3d3d3AAAAB3iIiIiIiIiIiIiIdwAAAAd4iIiId3eIh4h4d3cAAAAHeIiIiHd3iIeIh4h3AAAAB4iIiIiHd3eHiHh3dwAAAAeIiIiIh3d4iIiHeHcAAAAHiIiIiIh2d4iId4h3AAAAB3iIiIiId3eIeIeIdwAAAAeIiIiIiId3eIiIiHcAAAAHeIiIiIiHd3iIiIh3AAAAB4iIiIiIiHZ3iIiHdwAAAAeIiIiHd3d3d4iIiHcAAAAHiIiIh3MWVneIiIh3AAAAB4iIiId3d3d3iIiIdwAAAAd3d3d3d3d3d3d3d3cAAAAHd3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3dwAAAAd3d3eHd3d3d3d3d3cAAAAHd3d3d3h4d3d3d3d3AAAAB3d3d3d3d3d3d3d3dwAAAAd3d3d3d3d3h3d3d3cAAAAHd3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3d3cAAAAAAHd3cAAAAAAHd3AAAAAAAAB3d3AAAAAAB3dwAAAAAAAAd4dwAAAAAAd3cAAAAAAAAHd3cAAAAAAHd3AAAAAAAAB3dwAAAAAAB3dwAAAAAAAAAAAAAAAAAAAAAAAAD/////8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/4P/D/+D/w//g/8P/4P/D/+H/w//////w==24:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":77,"unified_at_epoch_ms":1790344834826,"unified_at":"2026-09-25T14:00:34.826Z","metadata":{"hashes":{"sha256":"e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2","sha1":"4bcba41741021833e193e721f4461645ab7fdb43","md5":"06c82e99dc35ab88f2db7868d30012a8","sha512":"eefb63269cbb2f490affa47463fe7c2084cf273d5e60511c71c62c7942835c81d6f8ce89426fb48cee17993bb7dbe2e660ee9e78e5fb2903e366cd65acbfa613","ssdeep":"3072:glhbCOnBy2BY+JRz6T0sBTQqgnl0tPQTVo9:glhb3nPiWU6mtIRo9","ssdeep_chunks":["3072:glhbCOn","3072:lhbCOnB","3072:hbCOnBy","3072:bCOnBy2","3072:COnBy2B","3072:OnBy2BY","3072:nBy2BY+","3072:By2BY+J","3072:y2BY+JR","3072:2BY+JRz","3072:BY+JRz6","3072:Y+JRz6T","3072:+JRz6T0","3072:JRz6T0s","3072:Rz6T0sB","3072:z6T0sBT","3072:6T0sBTQ","3072:T0sBTQq","3072:0sBTQqg","3072:sBTQqgn","3072:BTQqgnl","3072:TQqgnl0","3072:Qqgnl0t","3072:qgnl0tP","3072:gnl0tPQ","3072:nl0tPQT","3072:l0tPQTV","3072:0tPQTVo","3072:tPQTVo9","6144:glhbCOn","6144:lhbCOnB","6144:hbCOnBy","6144:bCOnBy2","6144:COnBy2B","6144:OnBy2BY","6144:nBy2BY+","6144:By2BY+J","6144:y2BY+JR","6144:2BY+JRz","6144:BY+JRz6","6144:Y+JRz6T","6144:+JRz6T0","6144:JRz6T0s","6144:Rz6T0sB","6144:z6T0sBT","6144:6T0sBTQ","6144:T0sBTQq","6144:0sBTQqg","6144:sBTQqgn","6144:BTQqgnl","6144:TQqgnl0","6144:Qqgnl0t","6144:qgnl0tP","6144:gnl0tPQ","6144:nl0tPQT","6144:l0tPQTV","6144:0tPQTVo","6144:tPQTVo9","3072:glhb3nP","3072:lhb3nPi","3072:hb3nPiW","3072:b3nPiWU","3072:3nPiWU6","3072:nPiWU6m","3072:PiWU6mt","3072:iWU6mtI","3072:WU6mtIR","3072:U6mtIRo","3072:6mtIRo9"],"imphash":"e4fd7bd65f92565abe6ebb5858ca70ae"},"file_info":{"file_name":"UYTd46732","file_type":["peexe","executable"],"file_type_id":"exe","file_size":177664,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1512129022000,"last_seen":1677307704000,"last_multi_scan":1677307704000}},"detections":{"summary":{"verdict":"malicious","score":77,"tags":["ransomware"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":10,"malicious_count":5,"total":23},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 42924-745-00407E01","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"RSDS# POjQc:\\bt\\21\\src\\client\\office\\obfuscate\\obj\\i386\\oOGALegit.pdb|7[ 4P@{05CA9FB0-3E3E-4b36-BF41-0E3A5CAA8CD8}D@*@\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"taskkill.exe\" with commandline \"taskkill /F /T /PID 3028\" (UID: 00015711-00003124)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"BazisVirtualCDBus.inf\" has type \"data\"\n \"MSOUC.EXE\" has type \"data\"\n \"AUDIOSEARCHMAIN.DLL\" has type \"data\"\n \"MSSP7ES.DLL\" has type \"data\"\n \"vmnt64.exe\" has type \"data\"\n \"SOLVER32.DLL\" has type \"data\"\n \"SCNPST32.DLL\" has type \"DOS executable (COM)\"\n \"CSS7DATA000C.DLL\" has type \"data\"\n \"c2.dll\" has type \"data\"\n \"MLCFG32.CPL\" has type \"data\"\n \"ogalegit.dll\" has type \"data\"\n \"rpcapd.exe\" has type \"data\"\n \"Qt5Gui.dll\" has type \"data\"\n \"OUTLPH.DLL\" has type \"data\"\n \"c1.dll\" has type \"data\"\n \"PSTPRX32.DLL\" has type \"data\"\n \"liblzma-5.dll\" has type \"data\"\n \"dumpbin.exe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/TR/html4/strict.dtd\"\n Pattern match: \"https://supp7.freshdesk.com/support/tickets/new\"\n Pattern match: \"https://www.torproject.org/projects/torbrowser.html.en\"\n Pattern match: \"http://n224ezvhg4sgyamb.onion/sup.php\"\n Pattern match: \"8f.frBY/'Ja\"\n Heuristic match: \"'wSj.PE\"\n Heuristic match: \"+3E]D$L$PQURi D$PW^Ut4=.xt=.t=.tt\"\n Pattern match: \"b-Fo.SBn/@evXfHK\\SJvOHy.!A/7;ElO$ZRDJ0Xu\"\n Heuristic match: \"k_@b5/.ir\"\n Pattern match: \"crl.verisign.com/ThawteTimestampingCA.crl0U%0\"\n Pattern match: \"http://crl.verisign.com/tss-ca.crl0U%0\"\n Pattern match: \"http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O+C0A0?+03http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0\"\n Pattern match: \"http://www.microsoft.com/genuine0\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2.exe.bin\" was detected as \"Microsoft visual C++ 8\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.16354646902","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"8+EEx+MMUUEPhp@MQwEEUU}sIEEHUUBUUBUUBULEEMQUREEEE}syMUD%MMAXUELUUJYEMTEEPZMUD%MMA[UUx]yOpSUEMUBEMQUEHMU#UE#EMExjMUEUMMMU#UE#EMQEVMUEUMMMU#UE#EMQEp $MUEUMMMU#UE#EMQEMUE\" (Indicator: \"qemu\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"SCNPST32.DLL\" has type \"DOS executable (COM)\"\n \"ml.exe\" has type \"PDP-11 pure executable\"\n \"Google Chrome.lnk\" has type \"COM executable for DOS\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%APPDATA%\\e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$22","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"Found dropped filename \"dictionary.alcatel-lucent.aaa\" which has been seen in the context of ransomware (Indicator: .aaa)","origin":"Binary File","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeW\n GetStartupInfoW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n LoadLibraryExW\n VirtualProtect\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n TerminateProcess\n GetModuleHandleA\n WriteFile\n ExitThread\n GetModuleHandleW\n GetModuleHandleExW\n OutputDebugStringW\n CreateFileW\n Sleep\n GetTickCount\n GetFileSize","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"taskkill.exe\" wrote bytes \"4053bc775858bd77186abd77653cbe770000000000bf8e770000000056cc8e77000000007cca8e77000000003768eb756a2cbe77d62dbe77000000002069eb750000000029a68e7700000000a48deb7500000000f70e8e7700000000\" to virtual address \"0x768F1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /F /T /PID 3028\" (UID: 00015711-00003124)","origin":"Monitored Target","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/68 Antivirus vendors marked sample as malicious (10% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 108)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 108)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 108)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":270,"files_written_count":72,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5a213fab7ca3e1107e24ab86","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":77,"malware_family":"Malware.Heuristic","submit_name":"UYTd46732","analysis_start_time":"2017-12-01T12:37:14+00:00","indicators_count":{"informative":8,"suspicious":14,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}],"processes":[{"pid":3028,"ppid":0,"name":"e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2.exe","command_line":"","sha256":"e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2","normalized_path":"C:\\e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2.exe","uid":"00014822-00003028","icon":"$23"},{"pid":3124,"ppid":3028,"name":"taskkill.exe","command_line":"taskkill /F /T /PID 3028","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00014822-00003028","uid":"00015711-00003124","icon":"$24"}],"all_imported_dlls":["ws2_32.dll","wkscli.dll","rpcss.dll","wbemsvc.dll","secur32.dll","ntdll.dll","winhttp.dll","apphelp.dll","mpr.dll","winsta.dll","user32.dll","imm32.dll","shlwapi.dll","clbcatq.dll","wbemprox.dll","wbemcomn.dll","lpk.dll","sechost.dll","rpcrt4.dll","framedynos.dll","netutils.dll","wmiutils.dll","msvcrt.dll","msvcr100.dll","rsaenh.dll","cryptbase.dll","ole32.dll","RpcRtRemote.dll","usp10.dll","msimg32.dll","msctf.dll","netapi32.dll","fastprox.dll","gdi32.dll","version.dll","sspicli.dll","nsi.dll","wtsapi32.dll","srvcli.dll","KernelBase.dll","cryptsp.dll","oleaut32.dll","dbghelp.dll","ntdsapi.dll","kernel32.dll","webio.dll","advapi32.dll","shell32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Read___ME.html","sha256":"e8e960fce95e4c42136a6982d9f43095983e82bd40b1fbefd18c02524c2ae28f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Calculator.lnk","sha256":"a09c9b3956ae97f1dce7010112ddfb707ed1f3c18a2edf6c600f7d3c73c44f07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Paint.lnk","sha256":"314b972170b6b51d7528f292a5f6700efd77dfee043e683f8c38a5e807808176","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Sticky Notes.lnk","sha256":"96b03ab317efd0413661771cea9889c3b739561fd48992c9af571ad5a0479443","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"GlobData","sha256":"ad669a1297a45999e9d46863eebd6602558d3d8670a2e5ca32e988ecebad16ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"GlobSettings","sha256":"050c4628ca4f0c780cb39b8275bebba3f23801b08858d70323937d64faa42523","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"6547d9b6403f329ded70ccf29c5cf75265e1473d9cb130aa13f5028bf82906e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"bdf78e550fb5f1bea78f3e2775841b635e28ca926d5b4368aa36779f9e5334fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"addressbook.acrodata","sha256":"f575a201f9d412215cdc23094f572ab97ca12f3e91f77b464a0bf40346d658ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"directories.acrodata","sha256":"39c5ab11ae38c2755700756de1b8008d8a0938206f5373924140d78ac81352a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"services_rdr.dat","sha256":"819a2f74a1a254d2f5e83e2e69af80f002028c7ac77121868a5772fafd31babd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"services_rdri.dat","sha256":"72750a8ed203ce7ce159481ac5498cc1d6fbd63eec6e734c1cc39e215eb6d225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"services_rdrk.dat","sha256":"5aebdad5e6a209f3fa167eddea477ed4a1b12bc6c1e88954f2d10bc1a71b49ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"InstallTime20150122214805","sha256":"6abc9a62befda55d171438b3cf9eea4844af69349d7f42f75e1fc197ac034642","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SiteSecurityServiceState.txt","sha256":"5848b918ec7f406780579cde542705da6a3189e8f4cf89f5922b9f92d1226c69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Telemetry.FailedProfileLocks.txt","sha256":"a5cf97dc2e71a93e2931a814a5ab480ba841e965ef55bb4669d9ee9d324c3d70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"addons.json","sha256":"1fc4629be76f1ca6b5c0b9d2bac6ad9a7064aff56b8ab8111bd002868f84f1f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"blocklist.xml","sha256":"3578db14040c0cbff7706640c792bb64cea35f48c4fa42520aed7cd97000c5c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"cert8.db","sha256":"5c1fe997540fb73f941c30be28bbd1ec94e5deb8380fe1aa7ec9640670ec8241","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"compatibility.ini","sha256":"85d25da5e05364ae4420e26c557597cfcdd7d7b45d3ddc42ab3d23046e146c83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"content-prefs.sqlite","sha256":"e7610bf8edc7e137ccadb98e9aedfcf5db6f09c8aaec0765ff33f150085c9b23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"state.json","sha256":"5ed56f54e8682447e0ab9fd188aef248be90b37cb3610cbd28bc3db12596e9ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"extensions.ini","sha256":"b3501766d112fb19481a1a1eaf7548e598987481863c0eac6cafeb7a182df231","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Google Chrome.lnk","sha256":"5b8ba115f251965d35bb85a6da0391192f899c1708f5e9a813875c6afe3312d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Mozilla Firefox.lnk","sha256":"f30de02cc861c0101b506ac3c447c48c9569b68382dbb747918096b95f761ba4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"c8898bbfddc73ee369c31a04d1ed78ec49157563932255bdf8f531c50b6def37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"0zIG0D.doc","sha256":"ad154b03d4289cbd7aee0c513a4e6315242a8faf7bdcc28fbd6d3d821242b4e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"a09fc41ae4d8cf039b39a4ae718de8c863aaf14490b50772cdf1b9fb200e039a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"6SZfLTu9z.doc","sha256":"65f29fb943b9e7fd9fff2f2c8763fe4658b02d8929bdb9bf033e2d80b0f05aaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"8d18e51452d57a32cb3e606f1bdfa58ec37a583edfb03a9c4b639e6c45b290b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"EKeaJO.doc","sha256":"0056abd77cd1f4285fc80d9bfde7dba118ff94248e5051ac4d96ba12c438d75b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"F3hzum1.doc","sha256":"102d41d915c7555d7957e6e44ff642da3a3da7eca67427218418e4b8b644064d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"dH1rDN9f9.doc","sha256":"647f435ad3bf50c99077a2702c007a0b0bafd2f6ad180c2a1c0179dadb284604","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"dgQJde60mPXhI.exe","sha256":"fecd781d098ef96714a0b0ee6c63f8f88063805bd4c69dc7a0d59dd7c5743255","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"dskCEJ.exe","sha256":"17a21930be08ced2d1b3c4df0ece2fbc9eda92a89cacd2cf51b23511d9ae074c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"hKY8.doc","sha256":"4534bea4d08543808961a64033e470fd46836a6d49b4270464b746c6e870295d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"hlchPBL.exe","sha256":"24cbcac4362feb584b0441708eba662d49cde5b2c8255bacef354a5b8a510282","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"kY01UeAiy5.exe","sha256":"f4f97494a07aafdf6d1f79d1f2116e3646b224b20d063555ae6a1b026a9ea360","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"fa181b88621181b4c28ca0a7c1b0b6e709af6a2e28f1b7e4a69ec8098b95adbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"36c085d07f74d33f1b2a1105d42402628db7dc5c056ed12e116d0f00c47a5865","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"mtgFs8Za.doc","sha256":"7b2819edab50a4ac39decc2cdfd9fac2a314edbec32fb91855e8e127a308126f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"rRgk91Ih5n.doc","sha256":"364d33391baa6c77f0645964eeee4a963653631ff0b572aa16c38d2012cd3fce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"tDUzYwYK5f.exe","sha256":"cbb15ee41d11c100577f18752794f8023b3f956e7704d5213036007ccb5897c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Desktop.lnk","sha256":"8e621510d77fd46b00b1b0dd1da77f580d895415013372ffde14faf3f7dc6008","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"autoexec.bat","sha256":"2e2e1e67581e0bd0e238eb4995eef876a350b6a8472df701b23f82338ae44bc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"BazisVirtualCDBus.inf","sha256":"0a5325e3e60ac4b98019d134e636647b275fbdb19f58f18c797fc25fd70d650f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSOUC.EXE","sha256":"7170431eb308284785f1759d7f86439952f672a312f29cf34e13d69973a7b303","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"AUDIOSEARCHMAIN.DLL","sha256":"ab96a68ca61152fed645bcad4a8f476e919c6c8ddcaf71974d885b4942ba21cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSSP7ES.DLL","sha256":"545b18103c3ab31e7f1490e3e97353a9e3f09e2852779c7fb07883b1cab02d02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"vmnt64.exe","sha256":"d874a6d409096ad3d5b9787d9f45cdc20b624eed66005f5a9fea92bad1c877ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SOLVER32.DLL","sha256":"84b82048e5f8bd963244c13a74101faaebca46b45f7891d457d2be91e44f9b52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SCNPST32.DLL","sha256":"e96702ea148634721138d714adaf779ce3c96b33285bc10d0af846e9a3f22666","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"CSS7DATA000C.DLL","sha256":"d48c75219111a928c065814eec09e7ed3742407e283a75c42473e6d1e150e095","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"c2.dll","sha256":"83678c5214003f4cca4a94652221730a9f2faaac009988ddd41cbba76b23cf0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MLCFG32.CPL","sha256":"a4ea97205c98cb1271a888f6720bca9f05a292d6b17adf8cbd9f5899ca629d0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ogalegit.dll","sha256":"9864fe053b7ba984b555820324fe69e130731ef16a34ec68d8624dd7c7b6eda1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"rpcapd.exe","sha256":"fe8116d9aebbf5891706af51582c351fd7ddc5287dd350e973d3dc8656edac80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Qt5Gui.dll","sha256":"41be34a354e9d0509ad5ca854e74b70421fd31e924bf111df609f1a7d9761a1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OUTLPH.DLL","sha256":"24b9a408879d31b0b75fa8a565a5c25da22ae742600d85484641dc64af21a4ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"c1.dll","sha256":"57b7394183bad2d8e743c6dc6092952ba156035557a8a6a6593692596f4621c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"PSTPRX32.DLL","sha256":"68d4c3ed85fe6f9e3991ad9477cee69f9f9af951e7f40d7c1d2a0ef59798c59c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"liblzma-5.dll","sha256":"f17d6851e49b4055ff757b249336c59a19f7f0297ff902cc097264315919c4fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"dumpbin.exe","sha256":"9654021fe2ad957ff565da9e1cc7f780ed08d69f74f058e024ded59451356f13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"c1xx.dll","sha256":"6845a12d3bc9b263984a6138367086edae42a0ac4286adbf7739515b981ba5f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"pgoui.dll","sha256":"65cf79f7441528aaaba3ca429430a1eafc084f0c10e4e33526b01b0a67586d75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SEQCHK10.DLL","sha256":"523393176d10178b1318b6dd46821b5c2a15458b5ab6cff0e18aae030c0afdeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"uninstall.exe","sha256":"93d2043f85521041eebdfed5968551a83a3ffc76f30902174ca48c36fa0bf4c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libpangowin32-1.0-0.dll","sha256":"5f926f629f9e751d7e5a9fc51033a07c7636c7ef2b258b4086b2d94753dafe57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MAPIPH.DLL","sha256":"f76c67cfb44347d6fea52e819a2927f32aab68b5f962342c72b550e17f0fc90d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"CSS7DATA000A.DLL","sha256":"f7caa610abca0a4e6a6fad18f69db27184828b7a0cb89a33245a6f31087c5dc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"msvcp90d.dll","sha256":"1e381fb4fa02a2b6175befadfa6f6d8b0a9f620d39c38ea72c0941384e9a7907","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libfontconfig-1.dll","sha256":"bbe38f40936ef6037120955f90d251a6e26fbb38bb739e377d0a3b5bd4601ada","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libatk-1.0-0.dll","sha256":"fceebeffe72916a618aa5092507a697335c9232a0cd00cd5ea720fde2f1d11c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MCPS.DLL","sha256":"2e5617c8904352207e2a1e2335f2ef3d2d1e386c4e3b7775765399dd42c70de8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ONBttnOL.dll","sha256":"68767a4f46285eab521308ec76a1e0b97012b66afbc1026b27fc06421825528a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"PEOPLEDATAHANDLER.DLL","sha256":"3eaa4c6ba5854e89cd357e55630303e3be8c1191e284822174fe4522867b199e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libtiff-5.dll","sha256":"ac77b7f870dc80b108263f1a978a1b5cb00128545def76e2d2f4e962b2a7c7a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"oisctrl.dll","sha256":"0468fe7e13ebe2eb4c55d3d31ac5e74b010401a31dc63dd241486ec9eb802d17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Visual Studio 2008 Command Prompt.lnk","sha256":"83edbad91acc34abffea2715da45551d760d9b35e8bf823b464c338edcbe20ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"lib.exe","sha256":"07feb39ed9ea65b9a1d0e8f54bf7799c938e6d985e3fc3f9fd95a8a3789f3248","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"VirtualAutorunDisabler.exe","sha256":"5b8416c45af320b35b1d6fed3f732281e055a0006af012de1ed45d8931fb640e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Uninstall.exe","sha256":"76fbcf0b081a9a50501cf1d56b026deba2f0b6dcb7e175edb2c6a81b1c1d2513","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ose00002.exe","sha256":"92e0b60d78a1a314ea245aa54cf206a0771fe5953a9f61ad4bb7a822f32dbc62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"cvtres.exe","sha256":"d66743bb797e7736f36baca464e2ab8228a4e2c35de269e0f78100be8237ffc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSHY7ES.DLL","sha256":"5f917f194e73edce85b4335d3a656ebbe7a69f30cca1ea38bd0f4279d83578c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"EXSEC32.DLL","sha256":"e8150a38a87db1e8c8dc1f26fa5e2477f232bb8d67ac3f39de27ae1727a1b8be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"qwindows.dll","sha256":"821e237bd3ea0395eb12f599b87d30ca922aa307c813c72aea1b6bd322a33433","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"vcvars32.bat","sha256":"ecbc98c369395fcfc0de933c63295588a625aed31fc9e2b49cee484fe63f98fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SCANPST.EXE","sha256":"926789f04eea7a83d4ab928d17de2bbc1b122f9ec40e715a09e505eb23c6d92d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"TWRECC.DLL","sha256":"1ebe1fdad2c39130e310f374bdc7be82fbc3e30c81e47e7db1ca50c453dd94a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"IEAWSDC.DLL","sha256":"d600ba10e37f6e77f737fbececdfc4bfc4fa4ad000232ad68c3c02fa75527c59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libpangocairo-1.0-0.dll","sha256":"117537d2feceebc8d5592bacb39aecf28fd59f4b9f63cad6c6e25efbcdef1438","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"mscss7en.dll","sha256":"38368bb65220b99605470813b770df4dab2e5b4c7d7f48b7d0abbd9bf18c4639","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OFFRHD.DLL","sha256":"c1e0ccdba9fafdc1caa12b2b2ab133604bf68ba7ca4a14b4fc34a04796026a25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSQRY32.EXE","sha256":"6cfb9a6507aa92dd816fc330f1e9413beffb9a077097ce655dcac4b58e9c20e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SOCIALPROVIDER.DLL","sha256":"4769d04dd96499facade875fd167f289b59aa5d5769aaa6e2d97a96dd4a5287a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ONFILTER.DLL","sha256":"1c4b4306fb41d20b02c21d915ff33ac418302cd597d1db439441e600654c5f6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"VirtualAutorunDisablerPS.dll","sha256":"69ae3cc9689dbf828d268109fa20d0fb72231b27d0512762c6d833937d0d79ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OISGRAPH.DLL","sha256":"d9490e81ebe6883b5cf7030943dc3191ca91a5942a36608186dfb04e4c15370a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"TWRECE.DLL","sha256":"34381fa1fa0ff03515ae7c85f2d4e33b6ca83540223ce62537bf9d5d2a48d800","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"VCProjectEngine.dll","sha256":"5b38feca3c9168a6f6cfbb60f11309419f7ad9fa1449586fa2bf4eba02b25d50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"linkui.dll","sha256":"9f2c3e3978a1598043c96959314b9189932b5b38cde021feca877b8282f469ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"INTLDATE.DLL","sha256":"cb30b08a19632919431f53f87557c9e6e9533ac1e35b023a608a40e6e6993eed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libgio-2.0-0.dll","sha256":"095b7b7b7a9c1821d8e8a8b51fdd610b049491188fdb3a6a9c0e64b7ef715241","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OWSCLT.DLL","sha256":"eeba4205dcabea7aa69927818c6a2a1f00e8890380dfc35c7f8f18e0a3997b55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"PUBCONV.DLL","sha256":"836b54f6166edbcb071cfcdba026bb74538186e48ff309f8097225452ba54576","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ias.exe","sha256":"c2aed33ded3ce97b55ea575090ef683e4438d41af335ef1d114b5b9b65ce36af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"TWSTRUCT.DLL","sha256":"4e8e2c307984035afdee3e564aae08b756f7947086afc3f36c62f7cbf11b2221","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Qt5Widgets.dll","sha256":"aff2cc39dc65691a7cb501d9621e6ba51235d4c638dce323874b4cc3613e5bf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ONBttnIE.dll","sha256":"b4f62043fc64324a66c539ad93f42be6c4fe0563b612ddbc583f236ceea42db8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SendToOneNOteFilter.dll","sha256":"f0af703e20847052eed53e2574dde808335f03e007e726a6ed25ab9c54057b61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"EMSMDB32.DLL","sha256":"fd5f287bcffae0b2240756a6b4f37928ffc142b251c89095f6cdbdc6ba2add2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ONBttnWD.dll","sha256":"69b7c2e02ade78c581a5d626bff60349baba2b5d595c8be4347f8942eb2c108e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libgthread-2.0-0.dll","sha256":"a30468b0e9f354116852f2ce3fb984f8b52c5591180d65aa2c40ba75697867e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"mofl.dll","sha256":"64d08042b06a00cd232c75389b673765387af69a764ea6f51347e58719d694f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"batchmnt64.exe","sha256":"e34a89e6e732034a9829bb3e4fc248b053df1f8e3459ced1a99456c03699c72a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"rawshark.exe","sha256":"484be015023e5606d094a9388f25de7426bddfcf20ccc4ed00ecbbf43a6fa029","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ml.exe","sha256":"6caf096d12fac4dccd9dd26140438a8ff4f3d8ab786cce630c7cd5c96920b05c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"pgocvt.exe","sha256":"3c2edbb20e4c11531668e59a1274f43a89614820a2e2f81e450dcaa9c7aa7422","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"NL7Lexicons0011.DLL","sha256":"80f9f63e209900bda9fcbee1b238cb318546b01695f501feed497c19976bd9a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Qt5PrintSupport.dll","sha256":"d6ec64426756c02cfee45cfe98341c935225afe6d4695c72a10ec07211e32849","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"AUDIOSEARCHSAPIFE.DLL","sha256":"59f7a3621e3a99480d6e24f4670136b45f82f45765e7acd06133e4c683d3998a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSOHEV.DLL","sha256":"27345c53f6a847d69481a5f913b94820ded70ba4d70cc46b800969d1e5fedb24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"mscss7es.dll","sha256":"fb76a525214b208469cb5d1cce36bbea2427782a5fc036c784d5194aa946f793","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"AcroRead.msi","sha256":"74d7989d79888652f5139951f5a721bc089286bc0c7dfee48e383d969dd7e79f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSOCF.DLL","sha256":"ddb1f192194a87b43bb7b6cb820b43d40386e5ef017e2db98a23e77137680ea7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"vcbuildui.dll","sha256":"11fefb6db29b54f1a99878b05777425e2420151c91a9326906e6f6d8aefd5f72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"msvcr90d.dll","sha256":"ee12c99a4b526b6887bda42643730b315adabafadda3ce9f5dac01d7fee1bc1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libpixman-1-0.dll","sha256":"7eba4be5bf5c09bcd6721635348c1c40385652a410420c3527253df14236058d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Visual Studio 2008 Itanium Cross Tools Command Prompt.lnk","sha256":"c30dd3e8f57c93b1a6bc10266fd31105f7c8d547608b32885b855bb9511cc33c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"link.exe","sha256":"8faf7ed575b627e0604f7a31d7588fd3a68bb7c30dacb8a23c1eafa3e9543f5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ONLNTCOMLIB.DLL","sha256":"7e3fa77451108be7a3933c67ffafeaa815477c6e6e4ef4e772b54e3a10ea8551","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSOSTYLE.DLL","sha256":"1822b2c90eb6d0784638c33782a9a904c395f24c46eb343ba4c3e6a0dfe4ab8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"AUDIOSEARCHLTS.DLL","sha256":"b7e9bcea2798294113727c60cf63351aa809cad214f3eef80382a405a7ec4cc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libgail.dll","sha256":"b35f4fb93be1502f5e1d895e17117b073d3b3c675f2b6331309844cb6da3c311","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"maintenanceservice.exe","sha256":"8df81c20ff4575c2ad7045cbd467d9a48570952583539475b7cf287902cab65b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"TaxonomyControl.dll","sha256":"5baa74cbd8b96d1b58120d6df13cb1e2147700858a17d583fb0d3c5cbda3f27b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"javaws.exe","sha256":"b8706fa1327bf497a4a0c1c76cccfe2db9cf0626b0aa40544d1d6e18e8a59ed5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"FORM.DLL","sha256":"f60389d4e0a1c4beff0585b1a5a4f3dbc4d63f99c06965e6441b308a5666a52a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSOHTMED.EXE","sha256":"0b5d44e4286fd254aeb12750be6f9d2267bdc1260f956a5d171d1da0e2204415","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"vcvarsx86_ia64.bat","sha256":"b691c38aedcb153e9ba7e7e5d94076054602542f5a36ffffaeda5ef1253ef2a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSTH7FR.DLL","sha256":"47580759e96727f6ce92d0ac981d9534c00a708307275bcc59e2f037d3171e04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ContactPicker.dll","sha256":"88324cdc6a3abaf51222a7e457825f94f3dd84cd4b72cd65926982b3e3b5b72e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MLSHEXT.DLL","sha256":"6a696582ed06988f00bd0f8728ec1df364fd5214d8bd113e62e13bb0c1b63a2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libharfbuzz-0.dll","sha256":"3d02b4a5f9cf13c9163cd466d080c2f3ba65626b8afc40d77b35760313195ea0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SCNPST64.DLL","sha256":"127df9fd09bf3485360ddead5731978d456dcf864fd61aac60f7465a14bba042","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSHY7FR.DLL","sha256":"76b3a7e325820740f4aff8694f9d21192665eb72bddbc858b8e19065bd65f1ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"javaw.exe","sha256":"a349eed18cdc6b6e7dbc379332628a47b82a6b4bc5be7be3bbc7013b195b0b41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OneNoteSyncPC.dll","sha256":"06f871f698301835a7aceba5f5721a495f8f300af5dd40fefaf7d8e2d8c42e8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"NPSPWRAP.DLL","sha256":"b3868b73ef6eba9c3ccb88abdcd77e9b822266daf15bdc8dcf2dbd6752982b9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OIS.EXE","sha256":"6d99e471a99b6c78a7436710bdff336186ea0ae9eebed2e328f86791c804ceed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"pgomgr.exe","sha256":"7a129d85d36259843e1afb3052869fafb46495cafd64afe71c2942aa8fa1cafe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"pgodb90.dll","sha256":"62582c36a98ee2a6e9ab338b56bc45b24c12fd84f54f198c43bb4d92f00c224b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"REVERSE.DLL","sha256":"58fc0c759f77a99bf7fbfb98b0a10796a02306d5286870da5a9d97d1c6b9748f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSGR3ES.DLL","sha256":"1b3a5f8eaf9a70b31f3e5acfe43f58f0cf873820157546344a01ae71bec3b1ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"vcvarsx86_amd64.bat","sha256":"d1a727311194687ca105392e3ba1b0ec6d67a35df7d62e4dc25531d9b88dece3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"VCProjectAMD64Platform.dll","sha256":"0349b098a8026ac185cdfbc01a6200757fb59dd921a2eae8a99d70da25d2e66c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OEMPRINT.CAT","sha256":"783794778aae1a12d942731e0f10b3a8ee991d9f48eb21152341971b57d12e55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libjasper-1.dll","sha256":"ef58962d36a7c6328d05475a308dc581a1a9859e988fe89eceeb4c20a75aa989","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"NAMECONTROLPROXY.DLL","sha256":"b3f5d32cf48b2ad33ccfbd1265733aadea86a97eb52aa1b99b00df36de4bfe3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SETLANG.EXE","sha256":"4fa1bd69d4067bf90ac6c68aeb72bf4d89ac34d1940ac5c5fde156fbcdc940f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"vcomp90ui.dll","sha256":"1c9e938843299b4ec9a9d02cb7ed20ce985c20f11fd5218fa3deca36fb7566f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"pgort90.dll","sha256":"580b53859dddd040933bfdc483417e2484b97453b80d9b018e036f30bed48036","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libfreetype-6.dll","sha256":"8ff2ad560a3e7fa12c6c3e1a984f0a225ae70c0ca3006cbfdcb3af7b23c6438e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ONENOTE.EXE","sha256":"f0b7736042503428c09d1354a639bea15ec3962aa50db5ed2dcb7e8fe20e5de2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libjpeg-8.dll","sha256":"1677d917c4187429903dc47163e41cff7e42f5f4f74394467750203a937e68ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SSGEN.DLL","sha256":"6d2432c06b3377c4cae6545ab261938b328d63dba8d609b2f2c59a7bb60f0579","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"NAME.DLL","sha256":"58464fa8ab12ae34a50766cc17aeff58b45752c15b0c77ad6656583a16beb578","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"msvcm90d.dll","sha256":"ea761cd4d6702bd9c7067e2682d2c93c47bc4990f1226065d9714bd10a14b5d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libpango-1.0-0.dll","sha256":"1adf7ba89d721d4ca1165d10bbc7c4fe8c674724ce4394fd241df9f39306da5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"mspdb80.dll","sha256":"be93790787b956b035e3d9b63452d42146e9e0d6c78a3f68dffccad0ed3b10ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"nmake.exe","sha256":"6166837d50c0e494188684e6251bc60dbdcb3d3c44ac4eadd580106603f489de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"NPAUTHZ.DLL","sha256":"55a6dacacb40ed669f4571fdf2e74c78093aa962cfeb99ce3a6a91ab219a271c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"mspft80.dll","sha256":"85a0b8499ea9e12cde130161089b4e47dfab5f187e9c00ed5c895d802ceef471","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"REFEDIT.DLL","sha256":"412041e51e4d2ec987b4b23897ec7922ee22f3c609e3a53c84bc096053613a62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"bazisvirtualcdbus.cat","sha256":"251a435a4d9e473f595c9d4e1922a2c7a7169e76c902e8d4544eed0809665930","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"mset7tk.dll","sha256":"b908f150ddd4e930580ef723f24afb5f3fd87fc344f0800cab8b97b9c6ca34a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"symdbg.dll","sha256":"aa759a419d7dd884a0bed4b71d10978dd24b171400c906fe010cc03f28725858","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSTORDB.EXE","sha256":"ceae6a094b6c206904dff5d4a4af07e2fd6cc483b0d0ae7e3693124a16c54261","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSTORE.EXE","sha256":"a7551fe148e8d58c7e8852c928ed4a8c6ac84b7700135bfa7231650b2f69c9b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"GKExcel.dll","sha256":"b887a6607d806df1150995d0dd129a55457feb58be0f91b6036863270fd57ffb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"CDLMSO.DLL","sha256":"a62c2fdc68d5db319e232c96d4ac3f718292d4a03973af7fba71920d79a8ca03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Visual Studio 2008 x64 Cross Tools Command Prompt.lnk","sha256":"197a401b4b0d167770b81fdf7cb125d401d0273912da2197b8a358dec64eccda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OFFXML.DLL","sha256":"2da1a62b0e388ab94142807bd87aa8e146926ccc84bb926e8c68a73af4b3283f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSOCFUIUTILITIESDLL.DLL","sha256":"06ae9c8d98b6922bce822e8072b12999030333d1da5dccbae8a5b4ef8acecc77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"IMPMAIL.DLL","sha256":"8d8b5b58ddcde111349b263c7ba23c9dc5fdd396df1eba7f4d8bfb19989e3556","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SAEXT.DLL","sha256":"901186a2306124994ca683b74fed55b493c0587e82bd447a803ef26577db4ff3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSOCFU.DLL","sha256":"9a55fc7ca4c5ede7c4e331b672e845075b9a8524301fef62aa5f6eafb3fa0efd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"TWCUTCHR.DLL","sha256":"c9e5c71a6ea43431a72c9ebb53b29f1ce9388c89b485b1249a90fdcf28af43c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"mspdbsrv.exe","sha256":"8d10a52a1e79acc6c15fc715cb3a2a507da495a165efed94552aa212085419e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"STSUPLD.DLL","sha256":"f47d4aec4daa0474aebc092b5a909759d215e22860a8a05885b351d54a958319","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSGR3EN.DLL","sha256":"36f3961734c537794d9bfd17862d5b367da164e0503fde83194ae2a2409a2e2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"setup.exe","sha256":"a6a319e0e44f5b06eb67c1e3a287d1dd428f8d7b35a338019fac7114598f674e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"mspdbcore.dll","sha256":"929c83e57a028f438e6f83b60b5aa9da783d5dda1394544887e506fd6c5daf71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"pgort90ui.dll","sha256":"f7fc21bcb427ead19835b0bf552a4b0ba8201b2e1a02bc14080a27899a6f5ab9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ONENOTEM.EXE","sha256":"b97bf16c3e57e1db37197466ad1996455316cb97db0015cf61a7257fb324ac66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"PPTICO.EXE","sha256":"4ef3427f02c40771a5a7e2d42e1eb1c2545edf7632a0ae216fbc6d9b4976af80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"PUBTRAP.DLL","sha256":"08b8e4ddcb1f73b5961330657f707b44150d62f7cba96999210afd9248ed4e8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"STSCOPY.DLL","sha256":"743e64b6b138d8b9cac9671ba8a384d2e21053afb95cb75d09d5f798fd160480","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"editbin.exe","sha256":"ca150a59ddcec7572585c3a47aa469f18a9cefdca086073410bc7d12f6141aa6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"CONTAB32.DLL","sha256":"ea910228f215dca22d517a7dc273e23306ad6aacb4768e1a9aea80558cdd4424","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSSP7FR.DLL","sha256":"c0fbf7d4792a67136ce510fc41ccb36dcf3adcedab972afd54e9aa56e5679c48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MAPISHELL.DLL","sha256":"cd8daa13203ebe0974808210ca5accf9fc2a751e6f8363364c355288b8bee64c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"STSLIST.DLL","sha256":"556a32b807526de16561268d363b66e9288769b8f66eec8b00d0304bdaa837e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSOHEVI.DLL","sha256":"78c1ee6284f6dc33eeb0415622172e254cd451caaf8699fca8fb9ccc3702475e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSODCW.DLL","sha256":"6927d97547c9388a8d96abb86de9f46edfb77b325010a22253c02e7e96f6f523","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"libwimp.dll","sha256":"063ad2c05a674dadd33a9ca8fb8e16a35a7a4ca166eae2119b8a2531ac13107e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSCOL11.INF","sha256":"f2baf49e7b6794fe42da3e00436229488afad56965283c50d85e67f9f2d67c2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"mscss7fr.dll","sha256":"ee2deea037fbee026ccd148d0e9de5adf5e80278a86b791da340a70241ea40e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OLMAPI32.DLL","sha256":"476ad9440ea282ab6d4d4f03ad594fc1b569cd371cad71d7a45d0a87ef4f2aa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MSHY7EN.DLL","sha256":"02c23df90bca637e6d87c0fab647c13efe8b43d1d824825e15c9d66fc180044d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"GKPowerPoint.dll","sha256":"9cb17a6f6aad4f8b25ca32930dc5d985b289321dc223b8e157b6ea1ceb3b13eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"user-guide.chm","sha256":"1a7266fb3bf53446b0ed4f1a322c8577c4f80d5e7b1dbb1abba0f6849da03c35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"qtshark.exe","sha256":"0b402802c69c737c8b14dfd3a65fc375fcc24167111feeaff6f370c98404fe19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"uninstall64.exe","sha256":"0514a1d2c28ac8bfff7c6558f7e6128a0c8bf89f79422467052db513f81d2f1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"POWERPNT.EXE","sha256":"bf6035c9afc6818ae4cfdc3a4cb81329f32a82efa9a564ea41f2fb01f75e0f12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SELFCERT.EXE","sha256":"5721547f9454703e1d64bd8c092ca00d8cdf51bd02657d9482c52e45145ebf2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"VCProjectIA64Platform.dll","sha256":"573604e8a17df03c8aea73c4cad2e34cbd8102dea610164d2873c92fc947e209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"vcbuild.dll","sha256":"0002372e1e78e9f0b926cdcf76162325c373b26755901df9dedeccbb4d41f8ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"THOCRAPI.DLL","sha256":"fd39d466c6232f28eda4ffb0045742956ee1934a9b7dba4d756cd7cf614a8c6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OLKFSTUB.DLL","sha256":"ebaa296593453313dc4ea964681bbaaec5dbe2e465e920212bf167de6544508d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ApothecaryMergeLetter.dotx","sha256":"ef7a409afa33a497a026cabaa00caf58d82ca44113bb9c454a37beb3f6f135a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"AdjacencyLetter.dotx","sha256":"313937870501921d04edae4a6555c14547c3c2e7f7cbce05d434126c455cb660","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ExecutiveNewsletter.dotx","sha256":"c78686b642d471cd85ba54cded1c5d72f1fcd41422f8ea2d55820321cab2a422","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ExecutiveLetter.dotx","sha256":"f1c153d199d1f2eeb26fc5c25067ebc722713d5e040231d525e7bb7ebc349159","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Blog.dotx","sha256":"324ced94bfd4e08f2b33f9174029fa14c42138e6c8a01abd864988c39d7970aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"FUNCRES.XLAM","sha256":"20a6f9a8ce9214a731ad97108d6adcac8a0df94cc05c7651f93e82dee6740ca1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"AdjacencyMergeLetter.dotx","sha256":"2c04b4b217d4f35da51423756c6db1038b95c10cc42938dd71445c9fae077618","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"BillingStatement.xltx","sha256":"e2fa3864504e6665f258d0f362ee319fc26019a1d0d57835f3f03642746cef0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ExecutiveResume.dotx","sha256":"0d8b09cf0e7f0416032e0cc65ffa3a202993360d6b3e6c1dbb997b094ae55769","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"BloodPressureTracker.xltx","sha256":"a8bd26f0fe143e906d7e670f3c1d40a5068123929035f8898000ab99aed12e92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"UrbanResume.Dotx","sha256":"12f6a78b6e5e27545f862c751bfc4341905ac72301d759a42f0d13d231871522","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"UrbanReport.Dotx","sha256":"50f0241849f9d6de17047ec6b92b150293182de7559e444b8ab9867075cfa3c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ContemporaryPhotoAlbum.potx","sha256":"b59a05821690adf78046af4392dc0a424ce49af8f04248340d3fa344a2f9e074","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OriginMergeLetter.Dotx","sha256":"57808e38d384742d85d7ce715c349750977800695e8a03caf31dc86d523d1cc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MedianMergeFax.Dotx","sha256":"cfce03ef2929aa9eede35779137bf7e3f17a57af08ba494e85c427f32bfcd66b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OrielReport.Dotx","sha256":"8e536acafa3775612eb8286192970a6437fc63bc347bce4cbbf08b31f8f522cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ApothecaryNewsletter.dotx","sha256":"d5ff4affae2aaed5197b349470c2cf4e3b617780c4eb41f346116a4f43e354e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ExpenseReport.xltx","sha256":"99625a42a8b29b3885643540cf3cf54663adebd208a4245e586aa7d855d18f3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ExecutiveMergeLetter.dotx","sha256":"98c99e4c3d899dacfeb4b1551ff03e5bf078fd9b23e78bd88ef0d8f607986c6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"LoanAmortization.xltx","sha256":"c596b6bdb92f1f8dac0adcee219092e12fdfc27735e9feed0844beb802e50d77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"EquityReport.Dotx","sha256":"7252cc78f892a0f00cfb07395f714dd59eaf294471c971455160e91c5214eaec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"EssentialResume.dotx","sha256":"6008107ed8a69c50bccf30ca246ecc9bddb932ba20e0d6d5f97639268a8b95d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OrielResume.Dotx","sha256":"1c53b38aa627f946c063069b68483c9f1f2eefdeb738b88069f2e896c9abd86b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"TimeCard.xltx","sha256":"799198d8f99eddc68aa3d8a727e3a84b80fa0c34306ee8ded1464ea763a4930d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"EquityLetter.Dotx","sha256":"3dc167cce101717cecc6b805dabc2b1c704990bf1bc9b7a9e712c07713a9d946","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"EquityResume.Dotx","sha256":"a73e7fb4d41a0f7e88dc8a2aa00fbf81f4164d66ca8a8245ed4ed4e9a549cf6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ATPVBAEN.XLAM","sha256":"13cb3ee9b25b1dbee99bb5c35195f535eb51c69932e90f1d67edaebc91d81f62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MedianReport.Dotx","sha256":"b05f45aee51da4374d6bdc846313059e462f1928e39fa58b7ef0a9702b59f4ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ApothecaryLetter.dotx","sha256":"fc5b76253c5165b5dd1718b6d14c6c19ed491cabf757f28ae48705a757b5696c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"AdjacencyResume.dotx","sha256":"d2d301ddf470a25d5d2d4f9b8cd1432245e42994930be34dea0d13c44a7e768e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OriginFax.Dotx","sha256":"ec8f8374fb72c6f387fae4006863d367c2e0f0db904082e7dc16dba09c61c82f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OriginResume.Dotx","sha256":"7abe0db892196d15b346290827636e2821aac977cf314b471a8be1850bd91454","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"EssentialMergeLetter.dotx","sha256":"990b6a026e979e669cef202a482074f86f5d1add974947b17f81e65399a3bddf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OriginLetter.Dotx","sha256":"4e9e72e0ee9b885e7eb551bf30505b323beec6aa4782cbb12f0a8b39b6bad963","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SOLVER.XLAM","sha256":"f0607bfec5e844b7369a73ad988c3a3ad3a8bf88ea17ec93da6581c6599f4cf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MedianResume.Dotx","sha256":"8b72a40dc332d1f43c868afc53092f7f2b4446dad579fbc68c8d61e79c26e7fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"Pitchbook.potx","sha256":"e89959709a7bbe00f9d0ad7b18db644409deb21d5819a180687a4e801f522049","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"PersonalMonthlyBudget.xltx","sha256":"8842ec825fb4d3384d0805c213e190749b70ce0d314c4ddcb9296dbbc261afe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"EssentialLetter.dotx","sha256":"12a6013b9f7b406dddd5a8bff4323d341a231009eea945d21278224361624806","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OrielMergeLetter.Dotx","sha256":"8dc9086ae32b13dfa98e4b00ea1be06f0964efe3a7f2ec4c779808aa81c83b1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"MedianMergeLetter.Dotx","sha256":"4e4be2002d2440d98e57360a954a1d694272611df3fcc4bebcebf82b5ac71481","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"OriginMergeFax.Dotx","sha256":"dc3fdc128db7d942876fe0efb3320f79e244f177726c932e3a5cb90e4527e208","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"EquityMergeFax.Dotx","sha256":"6d9fb33e38f5a70b163416127309a7068a017f309e922772e914abb06576ae87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"SalesReport.xltx","sha256":"58c4aa0a6f8ae53481c8ce99b79e6b5032054814e75458fa5c6c6cbcfb1a5b58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"UrbanMergeLetter.Dotx","sha256":"8c35b130c4e52bc9860d54d2cafd506ac2791d0fdfea9613292b849b25aa265c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"AdjacencyReport.dotx","sha256":"9396697be27236abf7c4beeaa66c6bc5f723c234708b3653187db0f450e29556","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"ProjectStatusReport.potx","sha256":"7bb5274e43b735bbbebfcc8e9aeb596de56435b1a644d4007e6e1b6b9f29fe83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"UrbanLetter.Dotx","sha256":"6a64fa68b996d917f6aff9777ce315bc8a65fef8350f19772c61fae0a05e41ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"PROCDB.XLAM","sha256":"82bdbfb8919c2b1fb69fd8d0f006232adc0629a051db117bc2085f3773554ba6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]}],"files_written":[{"path":"C:\\e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2.exe","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2.exe","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\AE09C984DF6E74640B3271EADB5DD7C65FDE806235B2CDA478E0EFA9129C09E7","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\1512128254717$OK","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\W4B.5aM","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%WINDIR%\\System32\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\nfgZGEnvp6yUz.EEW","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\ocTSmEgRFZNG7WBWURf8.a8s","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\Sc5x1luo3A3J4IcNRQ5YbtES.vMf","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\moMTNKwnI.V86","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\PjXBZz3az.JO3","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"C:\\Users\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Videos\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Recorded TV\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Pictures\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Music\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Libraries\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Downloads\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Documents\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%PUBLIC%\\Desktop\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Videos\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Searches\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Saved Games\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Pictures\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Music\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Links\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Favorites\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Downloads\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Documents\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Desktop\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%USERPROFILE%\\Contacts\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Wireshark\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\parent.lock","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\webapps\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\idb\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionstore-backups\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\gmp-gmpopenh264\\1.3\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\datareporting\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\crashes\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a213fab7ca3e1107e24ab86"}]}]}},"report_ids":{"sandbox_job_ids":["5a213fab7ca3e1107e24ab86"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample e2209f339b2e… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e2209f339b2e…. Malware family: Win/malicious_confidence_100%. Threat score 77/100. 1/1 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample e2209f339b2e… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e2209f339b2e…. Malware family: Win/malicious_confidence_100%. Threat score 77/100. 1/1 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e2209f339b2e5afbb40d4f3dfddf4939ffdb9accbb5253121707a5b1cde15dd2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample e2209f339b2e… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e2209f339b2e…. Malware family: Win/malicious_confidence_100%. Threat score 77/100. 1/1 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L25","11",{}]]