24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Generic Trojan.ai Sample f32f8ca082b5… — Score 96/100 — Hybrid Analysis","description":"Malicious verdict for sample f32f8ca082b5…. Malware family: Generic Trojan.ai. Threat score 96/100. 0/0 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f32f8ca082b53db965eb91576c3566a7e0ad41f21c79a5a9b54c5be473d9aa5c","keywords":["Malicious","Generic Trojan.ai","malware analysis","sandbox report","threat intelligence","f32f8ca082b53db965eb91576c3566a7e0ad41f21c79a5a9b54c5be473d9aa5c"],"about":{"@type":"SoftwareApplication","name":"mscoree","applicationCategory":["pedll","executable"],"identifier":"f32f8ca082b53db965eb91576c3566a7e0ad41f21c79a5a9b54c5be473d9aa5c","additionalType":"Malicious sample"},"threatScore":96,"malwareFamily":"Generic Trojan.ai","antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":4,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T674,Process "iexplore.exe" (UID: 00015841-00003156) was launched with new environment variables: "PATH="C:\Program Files\Internet Explorer;"" Process "rundll32.exe" (UID: 00015858-00000536) was launched with missing environment variables: "PATH" Process "iexplore.exe" (UID: 00015884-00004120) was launched with new environment variables: "PATH="C:\Program Files\Internet Explorer;"" Process "rundll32.exe" (UID: 00015986-00004672) was launched with missing environment variables: "PATH" Process "iexplore.exe" (UID: 00016032-00004344) was launched with new environment variables: "PATH="C:\Program Files\Internet Explorer;"" Process "rundll32.exe" (UID: 00016037-00004340) was launched with missing environment variables: "PATH" Process "iexplore.exe" (UID: 00016155-00003756) was launched with new environment variables: "PATH="C:\Program Files\Internet Explorer;"" Process "rundll32.exe" (UID: 00016206-00000316) was launched with missing environment variables: "PATH" Process "msicuu2.exe" (UID: 00019850-00006056) was launched with modified environment variables: "Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP" Process "msicuu2.exe" (UID: 00019850-00006056) was launched with missing environment variables: "LOGONSERVER, PROMPT, VXDIR, HOMEPATH, HOMEDRIVE" Process "rundll32.exe" (UID: 00019962-00005596) was launched with new environment variables: "LOGONSERVER="\\HAPUBWS-PC", PROMPT="$P$G", VXDIR="C:\VxStream", HOMEPATH="\Users\HYbsG9y", HOMEDRIVE="C:"" Process "rundll32.exe" (UID: 00019962-00005596) was launched with modified environment variables: "Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP"26:T789,Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#1" (UID: 00014358-00003068) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#2" (UID: 00014522-00003544) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#3" (UID: 00014650-00000172) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#4" (UID: 00014664-00004588) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#5" (UID: 00014792-00002868) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#6" (UID: 00014921-00000644) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#7" (UID: 00015050-00003864) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#8" (UID: 00015073-00002188) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#9" (UID: 00015089-00002908) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#10" (UID: 00015218-00003912) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#11" (UID: 00015236-00002256) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#12" (UID: 00015365-00003272) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#13" (UID: 00015383-00003280) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#14" (UID: 00015401-00001316) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#15" (UID: 00015419-00003276) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#16" (UID: 00015449-00001944) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#17" (UID: 00015469-00003016) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#18" (UID: 00015487-00001760) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#19" (UID: 00015511-00004460) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#20" (UID: 00015531-00004060)27:T789,Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#1" (UID: 00014358-00003068) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#2" (UID: 00014522-00003544) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#3" (UID: 00014650-00000172) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#4" (UID: 00014664-00004588) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#5" (UID: 00014792-00002868) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#6" (UID: 00014921-00000644) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#7" (UID: 00015050-00003864) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#8" (UID: 00015073-00002188) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#9" (UID: 00015089-00002908) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#10" (UID: 00015218-00003912) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#11" (UID: 00015236-00002256) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#12" (UID: 00015365-00003272) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#13" (UID: 00015383-00003280) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#14" (UID: 00015401-00001316) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#15" (UID: 00015419-00003276) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#16" (UID: 00015449-00001944) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#17" (UID: 00015469-00003016) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#18" (UID: 00015487-00001760) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#19" (UID: 00015511-00004460) Spawned process "rundll32.exe" with commandline ""C:\mscoree.dll",#20" (UID: 00015531-00004060)28:T562,"urlblockindex_1_.bin" has type "data" "mvef11.bat" has type "ASCII text with CRLF line terminators" "msicuu2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "_5D73577A-56A6-11E9-B10C-0A00270F0B64_.dat" has type "Composite Document File V2 Document Cannot read section info" "7848SE9G.txt" has type "ASCII text" "suggestions_1_.en-US" has type "data" "~DF8196183D32531FAE.TMP" has type "data" "142ca36c94693e11223ad7b15923879d_733c94c5-cebb-4f98-a75f-22a797d1d50b" has type "data" "ZSOGGMMJ.txt" has type "ASCII text" "~DF40B7BA075175D984.TMP" has type "data" "50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B" has type "data" "VMAF43SB.txt" has type "ASCII text" "~DF05F62AC91699CC67.TMP" has type "data" "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data 6572 bytes 1 file" "RCXBA53.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "_5F8C2978-56A6-11E9-B10C-0A00270F0B64_.dat" has type "Composite Document File V2 Document Cannot read section info" "dberr.txt" has type "ASCII text with CRLF line terminators" "verF6D4.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F" has type "data"29:Ta26,Heuristic match: "CatalogDB: 7:26:07 AM 12/5/2017: DONE Adding Catalog File (10ms): oem3.CAT" Heuristic match: "CatalogDB: 7:26:07 AM 12/5/2017: DONE Adding Catalog File (0ms): oem3.CAT" Heuristic match: "CatalogDB: 7:26:22 AM 12/5/2017: DONE Adding Catalog File (0ms): oem4.CAT" Heuristic match: "CatalogDB: 7:26:23 AM 12/5/2017: DONE Adding Catalog File (0ms): oem4.CAT" Heuristic match: "CatalogDB: 3:36:26 PM 12/5/2017: DONE Adding Catalog File (0ms): oem3.CAT" Heuristic match: "CatalogDB: 3:36:26 PM 12/5/2017: DONE Adding Catalog File (15ms): oem3.CAT" Heuristic match: "CatalogDB: 3:36:26 PM 12/5/2017: DONE Adding Catalog File (0ms): oem4.CAT" Heuristic match: "CatalogDB: 3:36:27 PM 12/5/2017: DONE Adding Catalog File (0ms): oem4.CAT" Heuristic match: "CatalogDB: 7:18:59 AM 7/26/2018: DONE Adding Catalog File (62ms): oem5.CAT" Heuristic match: "CatalogDB: 7:19:00 AM 7/26/2018: DONE Adding Catalog File (0ms): oem5.CAT" Heuristic match: "CatalogDB: 7:19:01 AM 7/26/2018: DONE Adding Catalog File (16ms): oem5.CAT" Heuristic match: "CatalogDB: 7:19:06 AM 7/26/2018: DONE Adding Catalog File (109ms): oem6.CAT" Heuristic match: "CatalogDB: 7:19:06 AM 7/26/2018: DONE Adding Catalog File (0ms): oem6.CAT" Heuristic match: "CatalogDB: 7:19:08 AM 7/26/2018: DONE Adding Catalog File (0ms): oem6.CAT" Heuristic match: "CatalogDB: 2:33:58 PM 2/1/2019: DONE Adding Catalog File (32ms): oem7.CAT" Heuristic match: "CatalogDB: 2:33:58 PM 2/1/2019: DONE Adding Catalog File (0ms): oem7.CAT" Heuristic match: "CatalogDB: 2:34:00 PM 2/1/2019: DONE Adding Catalog File (16ms): oem7.CAT" Heuristic match: "CatalogDB: 2:34:05 PM 2/1/2019: DONE Adding Catalog File (94ms): oem8.CAT" Heuristic match: "CatalogDB: 2:34:05 PM 2/1/2019: DONE Adding Catalog File (0ms): oem8.CAT" Heuristic match: "CatalogDB: 2:34:06 PM 2/1/2019: DONE Adding Catalog File (31ms): oem8.CAT" Heuristic match: "CatalogDB: 4:22:44 PM 2/1/2019: DONE Adding Catalog File (0ms): oem7.CAT" Heuristic match: "CatalogDB: 4:22:45 PM 2/1/2019: DONE Adding Catalog File (0ms): oem7.CAT" Heuristic match: "CatalogDB: 4:22:45 PM 2/1/2019: DONE Adding Catalog File (0ms): oem8.CAT" Heuristic match: "CatalogDB: 4:22:46 PM 2/1/2019: DONE Adding Catalog File (15ms): oem8.CAT" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=401352" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=513071" Pattern match: "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=rundll32.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0"2a:T10f9,Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: ""2b:T7e9,"iexplore.exe" wrote bytes "b0337b6e" to virtual address "0x76E314E0" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "a0357b6e" to virtual address "0x75DB131C" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "a0357b6e" to virtual address "0x771F1298" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "60cd7e6e" to virtual address "0x761E1E14" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b0337b6e" to virtual address "0x74B31038" (part of module "VERSION.DLL") "iexplore.exe" wrote bytes "70cc7e6e" to virtual address "0x75DB1310" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "b0337b6e" to virtual address "0x6C6EF6A0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "60cd7e6e" to virtual address "0x75DB130C" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "b0337b6e" to virtual address "0x7765917C" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "a0357b6e" to virtual address "0x777E1064" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "30307b6e" to virtual address "0x75DB1380" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "b0337b6e" to virtual address "0x75E111BC" (part of module "GDI32.DLL") "iexplore.exe" wrote bytes "b0337b6e" to virtual address "0x773B1164" (part of module "USP10.DLL") "iexplore.exe" wrote bytes "b0337b6e" to virtual address "0x771F1100" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "60d27e6e" to virtual address "0x761E1D7C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b0337b6e" to virtual address "0x75DB11B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "60d27e6e" to virtual address "0x75DB13B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "a0357b6e" to virtual address "0x7765B0CC" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "a0357b6e" to virtual address "0x75AE1144" (part of module "LPK.DLL") "iexplore.exe" wrote bytes "60d27e6e" to virtual address "0x6C6EFEC4" (part of module "IEFRAME.DLL")2c:T55e,"rundll32.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 552) "rundll32.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 552) "rundll32.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 552) "rundll32.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 544) "rundll32.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 544) "rundll32.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 544) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 892) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 892) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 892) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 876) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 876) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 876)2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8ACzERERERERAAAAAAAAAAAAu7MzMzMzEQAAAAAAAAAAAIiIszMzMzEAAAAAAAAAAAADMzMzMzEQAAAAAAAAAAAACIiIi7u7EAAAAAAAAAAAAAADMzMzMxAARERAAAAAAAAACLu7OxAARGdnZEAAAAAAAAi7uzMQBHZ2dmdkAAAAAAAIiLszECJnZ2Z2dkAAAAAAALu7MxAnd3Z2J2dAAAAAAAC7uzMXd3d3IiZ2ZAAAAAAAiIuzF3d3dyInZ2QAAAAAAAu7szGHdyIiJnZkAAAAAAALu7Mxh3ciIiJmZAAAAAAACIi7MYd3cidyIiQAAAAAAACLuzMY93ciciIkAAAAAAAAi7szGH93ciIiQAAAAAAAAIiLsxcndyIvsEAAAAAAAAALu7MxcndyIvsAAAAAAAAACIizMXInd3JLsAAAAAAAAACIuzEAIiIgALsAAAAAAAAAiLszEAAAAAALsAAAAAAAAAiLsxAAAAAAu7sAAAAAAAAIi7MxAAAAu7u7twAAAAAAALuzMxAAALu7sAALMzMzMzO7szMQAAALu7AAC7MzMzMzO7szMAAAC7u7AAu7MzMzO7u7szAAAAC7u7AIu7u7u7u4i7swAAAAC7u7iLiIiIiIiIi7MAAAAAu7uwiIiIiIiIiIi7AAAAAAu7AAAAAAAAAAAAAAAAAAAAsACAAf//gAH//4AB///AA///wAP///ADg//wDgD/8AwAf/AIAD/4CAA/+AAAH/gAAB/8AAAf/AAAH/wAAB/+AAAf/gAAP/4AAD//AAA//wAAH/+Bg4//gP/H/8D8A//AfgH/4D4PAAA/BwAAPwMAAD+BAAA/wAAAP8EAAD/j////9w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f32f8ca082b53db965eb91576c3566a7e0ad41f21c79a5a9b54c5be473d9aa5c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":96,"unified_at_epoch_ms":1790797885822,"unified_at":"2026-09-30T19:51:25.822Z","metadata":{"hashes":{"sha256":"f32f8ca082b53db965eb91576c3566a7e0ad41f21c79a5a9b54c5be473d9aa5c","sha1":"cb9d3c5aa6a882293eb1c65bbae686aadad89185","md5":"b9f23fcc6cb617e96f2b643972151cfd","sha512":"2d0c96f714aa216d943c5e25735d90d0861d97364359eba6dd091daaae4bc7cb7fd9e43ac2f722d04c56df5d67931ef1bd64389c79edf1d32c754f8f575a6170","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"mscoree","file_type":["pedll","executable"],"file_type_id":"dll","file_size":59713024,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1554361038000,"last_seen":1554361037000,"last_multi_scan":1554361037000}},"detections":{"summary":{"verdict":"malicious","score":96,"tags":["targeted"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":18,"suspicious_count":9,"malicious_count":4,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Generic Trojan.ai","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"tactic":"Execution","technique":"Local Job Scheduling","attack_id":"T1168","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1168","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"tactic":"Persistence","technique":"New Service","attack_id":"T1050","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1050","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00019850-00006056-1520-9-00BD1195","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00019850-00006056-1520-57-00BD159F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"173.223.75.4:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"rundll32.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"iexplore.exe\" created file \"%TEMP%\\~DF8196183D32531FAE.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DF05F62AC91699CC67.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DF40B7BA075175D984.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DFE0A73379656DDC39.TMP\"\n \"rundll32.exe\" created file \"%TEMP%\\mvef11.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"msicuu2.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00015841-00003156)\n Launches browser \"iexplore.exe\" (UID: 00015884-00004120)\n Launches browser \"iexplore.exe\" (UID: 00016032-00004344)\n Launches browser \"iexplore.exe\" (UID: 00016155-00003756)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 68070000\n \"rundll32.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 67570000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$25","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c %TEMP%\\mvef11.bat\" on 2019-4-4.08:53:52.544","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"cmd.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"rundll32.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"rundll32.exe\" touched file \"%WINDIR%\\System32\\rundll32.exe\"\n \"rundll32.exe\" touched file \"%WINDIR%\\AppPatch\\AcLayers.dll\"\n \"rundll32.exe\" touched file \"%WINDIR%\\System32\\en-US\\rundll32.exe.mui\"\n \"rundll32.exe\" touched file \"%PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.1A\\Lib\\mscoree.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\MSCORSVW\"; Key: \"DESCRIPTION\"; Value: \"Mscorsvw.exe is a process belonging to Microsoft .NET Framework. This program is a non-essential process, but should not be termin\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"rundll32.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"rundll32.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"\n \"rundll32.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"rundll32.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\WerFault.exe\", Handle: 260)\n \"rundll32.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 552)\n \"rundll32.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 544)\n \"rundll32.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\WerFault.exe\", Handle: 268)\n \"rundll32.exe\" is creating a new process (Handle: 272)\n \"rundll32.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\WerFault.exe\", Handle: 272)\n \"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 892)\n \"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 876)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"msicuu2.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"RCXBA53.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$2a","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 173.223.75.4 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"RCXBA53.tmp\" claimed CRC 324708 while the actual is CRC 49920","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesW\n LoadLibraryExA\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetProcAddress\n GetModuleHandleA\n GetModuleHandleW\n CreateFileW\n CreateProcessW\n Sleep\n TerminateProcess\n GetTickCount\n NtQueryInformationToken","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/65 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtOpenProcessToken@NTDLL.DLL at 00019850-00006056-1520-45-00BD1C54\n NtOpenProcessToken@NTDLL.DLL at 00019850-00006056-1520-47-00BD1CA4\n NtSetInformationProcess@NTDLL.DLL at 00019850-00006056-1520-7-00BD120F","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]}]},"activity":{"stats":{"process_count":130,"spawned_processes_count":130,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":128,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":153,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":11,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["targeted"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","Sample not shared"],"sandbox_reports":[{"id":"5ca5aacc028838a38544b9ef","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"Generic Trojan.ai","contacted_countries":["USA"],"submit_name":"mscoree","analysis_start_time":"2019-04-04T06:48:00+00:00","indicators_count":{"informative":18,"suspicious":10,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"173.223.75.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}],"processes":[{"pid":4508,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00014199-00004508"},{"pid":3068,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#1","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00014358-00003068"},{"pid":3544,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#2","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00014522-00003544"},{"pid":172,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#3","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00014650-00000172"},{"pid":4588,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#4","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00014664-00004588"},{"pid":4344,"ppid":4588,"name":"iexplore.exe","command_line":"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=rundll32.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00014664-00004588","uid":"00016032-00004344"},{"pid":3756,"ppid":4344,"name":"iexplore.exe","command_line":"SCODEF:4344 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00016032-00004344","uid":"00016155-00003756"},{"pid":2868,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#5","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00014792-00002868"},{"pid":3156,"ppid":2868,"name":"iexplore.exe","command_line":"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=rundll32.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00014792-00002868","uid":"00015841-00003156"},{"pid":4120,"ppid":3156,"name":"iexplore.exe","command_line":"SCODEF:3156 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00015841-00003156","uid":"00015884-00004120"},{"pid":644,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#6","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00014921-00000644"},{"pid":3864,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#7","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015050-00003864"},{"pid":2188,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#8","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015073-00002188"},{"pid":2908,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#9","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015089-00002908"},{"pid":3912,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#10","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015218-00003912"},{"pid":2256,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#11","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015236-00002256"},{"pid":3272,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#12","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015365-00003272"},{"pid":3280,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#13","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015383-00003280"},{"pid":1316,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#14","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015401-00001316"},{"pid":3276,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#15","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015419-00003276"},{"pid":1944,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#16","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015449-00001944"},{"pid":3016,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#17","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015469-00003016"},{"pid":1760,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#18","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015487-00001760"},{"pid":4460,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#19","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015511-00004460"},{"pid":4060,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#20","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015531-00004060"},{"pid":1748,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#21","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015582-00001748"},{"pid":3256,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#22","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015711-00003256"},{"pid":4000,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#23","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015736-00004000"},{"pid":4224,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#24","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015754-00004224"},{"pid":2960,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#25","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015771-00002960"},{"pid":4636,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#26","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015789-00004636"},{"pid":332,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#27","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015810-00000332"},{"pid":1848,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#28","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015833-00001848"},{"pid":536,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#29","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015858-00000536"},{"pid":4672,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#30","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00015986-00004672"},{"pid":4612,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#31","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016003-00004612"},{"pid":4676,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#32","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016019-00004676"},{"pid":4340,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#33","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016037-00004340"},{"pid":3732,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#34","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016077-00003732"},{"pid":316,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#35","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016206-00000316"},{"pid":4704,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#36","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016335-00004704"},{"pid":4572,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#37","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016352-00004572"},{"pid":1168,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#38","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016372-00001168"},{"pid":4680,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#39","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016501-00004680"},{"pid":5020,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#40","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016630-00005020"},{"pid":5296,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#41","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016759-00005296"},{"pid":5116,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#42","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00016888-00005116"},{"pid":5576,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#43","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017017-00005576"},{"pid":5632,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#44","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017034-00005632"},{"pid":5696,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#45","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017050-00005696"},{"pid":4984,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#46","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017107-00004984"},{"pid":4832,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#47","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017127-00004832"},{"pid":5156,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#48","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017256-00005156"},{"pid":4828,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#49","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017276-00004828"},{"pid":4856,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#50","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017295-00004856"},{"pid":5208,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#51","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017313-00005208"},{"pid":5784,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#52","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017329-00005784"},{"pid":5096,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#53","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017459-00005096"},{"pid":5204,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#54","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017573-00005204"},{"pid":5200,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#55","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017598-00005200"},{"pid":5032,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#56","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017618-00005032"},{"pid":5872,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#57","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017637-00005872"},{"pid":5008,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#58","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017704-00005008"},{"pid":4772,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#59","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017723-00004772"},{"pid":5300,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#60","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017745-00005300"},{"pid":4808,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#61","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017875-00004808"},{"pid":5232,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#62","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017892-00005232"},{"pid":5900,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#63","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017908-00005900"},{"pid":5828,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#64","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017923-00005828"},{"pid":5052,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#65","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017937-00005052"},{"pid":5048,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#66","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00017951-00005048"},{"pid":5972,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#67","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018080-00005972"},{"pid":5976,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#68","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018095-00005976"},{"pid":6052,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#69","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018224-00006052"},{"pid":6004,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#70","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018239-00006004"},{"pid":5128,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#71","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018370-00005128"},{"pid":6076,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#72","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018388-00006076"},{"pid":5988,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#73","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018405-00005988"},{"pid":5744,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#74","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018419-00005744"},{"pid":6108,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#75","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018548-00006108"},{"pid":6116,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#76","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018600-00006116"},{"pid":5804,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#77","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018729-00005804"},{"pid":5552,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#78","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018858-00005552"},{"pid":5588,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#79","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018875-00005588"},{"pid":5236,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#80","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018895-00005236"},{"pid":5268,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#81","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018913-00005268"},{"pid":5936,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#82","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018932-00005936"},{"pid":5932,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#83","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018948-00005932"},{"pid":5056,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#84","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018966-00005056"},{"pid":6128,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#85","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018981-00006128"},{"pid":5948,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#86","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00018999-00005948"},{"pid":5940,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#87","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019129-00005940"},{"pid":5344,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#88","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019148-00005344"},{"pid":5304,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#89","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019165-00005304"},{"pid":5716,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#90","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019182-00005716"},{"pid":5228,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#91","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019197-00005228"},{"pid":5224,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#92","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019218-00005224"},{"pid":3020,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#93","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019243-00003020"},{"pid":6088,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#94","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019265-00006088"},{"pid":4968,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#95","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019297-00004968"},{"pid":2292,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#97","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019427-00002292"},{"pid":1628,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#98","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019442-00001628"},{"pid":2512,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#99","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019457-00002512"},{"pid":6136,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#100","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019473-00006136"},{"pid":4132,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#101","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019487-00004132"},{"pid":3096,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#102","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019503-00003096"},{"pid":5736,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#103","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019527-00005736"},{"pid":5408,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#104","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019541-00005408"},{"pid":5704,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#105","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019671-00005704"},{"pid":5728,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#106","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019690-00005728"},{"pid":2620,"ppid":5728,"name":"cmd.exe","command_line":"/c %TEMP%\\mvef11.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019690-00005728","uid":"00020493-00002620"},{"pid":4280,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#107","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019820-00004280"},{"pid":324,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#108","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019832-00000324"},{"pid":5596,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#109","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00019962-00005596"},{"pid":2624,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#110","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020091-00002624"},{"pid":2564,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#111","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020221-00002564"},{"pid":2336,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#112","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020351-00002336"},{"pid":1916,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#113","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020481-00001916"},{"pid":2616,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#114","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020611-00002616"},{"pid":1688,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#115","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020634-00001688"},{"pid":3448,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#116","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020764-00003448"},{"pid":4104,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#117","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020783-00004104"},{"pid":3076,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#118","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020804-00003076"},{"pid":3436,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#119","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020830-00003436"},{"pid":684,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#120","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020847-00000684"},{"pid":284,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#121","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020860-00000284"},{"pid":1616,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#122","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020879-00001616"},{"pid":4440,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#123","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020892-00004440"},{"pid":3108,"ppid":4508,"name":"rundll32.exe","command_line":"\"C:\\mscoree.dll\",#124","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00014199-00004508","uid":"00020908-00003108"},{"pid":6056,"ppid":0,"name":"msicuu2.exe","command_line":"","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.1A\\Lib\\msicuu2.exe","uid":"00019850-00006056","icon":"$2d"}],"all_imported_dlls":["imagehlp.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msvcr100.dll","rsaenh.dll","Wldap32.dll","basecsp.dll","RpcRtRemote.dll","npmproxy.dll","webio.dll","sechost.dll","ieproxy.dll","dhcpcsvc.dll","wshqos.dll","winhttp.dll","lpk.dll","AcLayers.dll","iertutil.dll","IEShims.dll","secur32.dll","bcryptprimitives.dll","taskschd.dll","advpack.dll","uxtheme.dll","devobj.dll","WinSCard.dll","msvcr120_clr0400.dll","ntdll.dll","mscoreeis.dll","cryptbase.dll","ieframe.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","sxs.dll","clbcatq.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rpcss.dll","rasadhlp.dll","schannel.dll","KernelBase.dll","dnsapi.dll","dhcpcsvc6.dll","xmllite.dll","mshtml.dll","imm32.dll","setupapi.dll","netapi32.dll","bcrypt.dll","d2d1.dll","dwmapi.dll","propsys.dll","netprofm.dll","mscorlib.ni.dll","mscorsvc.dll","kernel32.dll","Culture.dll","sspicli.dll","urlmon.dll","sqmapi.dll","comdlg32.dll","IPHLPAPI.DLL","winnsi.dll","crypt32.dll","credssp.dll","wininet.dll","nsi.dll","srvcli.dll","rpcrt4.dll","version.dll","normaliz.dll","msasn1.dll","dui70.dll","linkinfo.dll","winsta.dll","userenv.dll","ieui.dll","mscorrc.dll","mpr.dll","dxgi.dll","dssenh.dll","wtsapi32.dll","cryptsp.dll","gpapi.dll","winbrand.dll","comctl32.dll","wship6.dll","WindowsCodecs.dll","msimg32.dll","advapi32.dll","ncrypt.dll","oleacc.dll","mscorwks.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","WSHTCPIP.DLL","oleaccrc.dll","duser.dll","msvcr80.dll","usp10.dll","msvcrt.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","nlaapi.dll","cryptnet.dll","DWrite.dll","apphelp.dll","wintrust.dll","SensApi.dll","profapi.dll","wkscli.dll","CORPerfMonExt.dll","user32.dll","shlwapi.dll","netutils.dll","clr.dll","gdi32.dll","shell32.dll","ws2_32.dll","FWPUCLNT.DLL","ExplorerFrame.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","ole32.dll","cfgmgr32.dll","oleaut32.dll","mscoreei.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","mscoree.dll","fusion.dll","msctf.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","mswsock.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"msicuu2.exe","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"en-US.2","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"verF790.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"mvef11.bat","sha256":"c9d2d376e7fad5f4f06019f4dbe17dde3ef85c1f6ce0f058569156607a6699bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"0083b08731318367ed166d3d5e84a817_733c94c5-cebb-4f98-a75f-22a797d1d50b","sha256":"115bad14f1c9f2c027a84de21b107015722cb76be8d0abf3760ad8e00d6c24a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"142ca36c94693e11223ad7b15923879d_733c94c5-cebb-4f98-a75f-22a797d1d50b","sha256":"140eda45fe001c0fe47edd7fc509ff1882d46fbcb7c7437d893c1fb83012e433","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"a158f6a8fad928c61b22be3f5ba8ba00_733c94c5-cebb-4f98-a75f-22a797d1d50b","sha256":"72275404c470b62a5ff49013e3f952d9480afd5c7e45b6c504235823da4894ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"fc1e3851f429ea606d6ff1e01a5229f1_733c94c5-cebb-4f98-a75f-22a797d1d50b","sha256":"4f832993e80787608cab4d15fe1f013339d01ff513864f1851b4f1d836269ce9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"7848SE9G.txt","sha256":"94867fd693fc5ebb31731efa74066c20382c34cdcf29509a90a340b67553b5c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"H9QUE12G.txt","sha256":"8fd6b1687462d640aad0df0056da7becb59271c96ff1e54638310b50cdfad143","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"VMAF43SB.txt","sha256":"a3b980866adcc8c64beb1c3918b96d28f4ce749063b3443874043d174e9c3d4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"ZSOGGMMJ.txt","sha256":"55166c431020300108eddab5519b88bced384eee294ae45f9eeb1c646f5d636a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"ZXGNCPDJ.txt","sha256":"71335697e058dbf367b20c3cd9b7d92cdc446e7444e73e4507f8bc561c1e397e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"ver79D.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"verF6D4.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B","sha256":"c63532210d1dee6c31f3062e5a226d1bcf8ff6ffd13cd4c41d15547e4403e880","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"485e29905a877814d44ee56f787d9dea014bede5900be5f333ed880ce6541da1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F","sha256":"444a8f639ceb77f9ce94ce6a541b8f16ce08b2b8a0c1d8a5b066c833f15f0048","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sha256":"9411351335162ef2b97bd188df6805b9832dc054034ffc9252ab65b2a4694c68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sha256":"a21874439718024618ae3778dfa1ca105acf4678f6d833acb176f130add0088c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"RCXBA53.tmp","sha256":"2b27ec77dc8fb1c28a4bc535a6844e1a89f7f3c3bc53719f0f8fce7a558e9f34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\mpatible","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\b04f6c2ae081ba990ff8fcfc8ad95d3e_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\system32\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\system32\\Microsoft\\Crypto\\RSA\\MachineKeys\\b04f6c2ae081ba990ff8fcfc8ad95d3e_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\system32\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\system32\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\system32\\Microsoft\\Crypto\\RSA\\MachineKeys","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\142ca36c94693e11223ad7b15923879d_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\0083b08731318367ed166d3d5e84a817_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\a158f6a8fad928c61b22be3f5ba8ba00_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\crypt32.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\dssenh.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\basecsp.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\en-US\\basecsp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\fc1e3851f429ea606d6ff1e01a5229f1_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\http:\\go.microsoft.com\\fwlink\\?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=rundll32.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.0","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%TEMP%\\~DF8196183D32531FAE.TMP","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%TEMP%\\~DF40B7BA075175D984.TMP","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\.config","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\catroot2\\dberr.txt","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_A7A8E86FCB076C144BD04C40841E7074","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\verF6D4.tmp","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\verF790.tmp","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver79D.tmp","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{5D73577A-56A6-11E9-B10C-0A00270F0B64}.dat","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%TEMP%\\~DF05F62AC91699CC67.TMP","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{EC911C1B-56A5-11E9-B10C-0A00270F0B64}.dat","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{5F8C2978-56A6-11E9-B10C-0A00270F0B64}.dat","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%TEMP%\\~DFE0A73379656DDC39.TMP","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\az","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{EE5C4DD1-56A5-11E9-B10C-0A00270F0B64}.dat","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ngenservicelock.dat","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Microsoft SDKs","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Microsoft SDKs\\Windows","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.1A","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.1A\\Lib","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.1A\\Lib\\msicuu2.exe","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\mscoree.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.1A\\Lib\\mscoree.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.1A\\Lib\\RCXBA53.tmp","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.1A\\Lib\\en-US\\msicuu2.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.1A\\Lib\\en\\msicuu2.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%TEMP%\\mvef11.bat","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\Users\\HYbsG9y","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\৏","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index357.dat","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\rundll32.exe.config","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"C:\\mscoree.dll","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_49FC544F04082FD9F64F9EFB226AF8B5","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7848SE9G.txt","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VMAF43SB.txt","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H9QUE12G.txt","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.2","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\50D6B15D9F2DCE1EDBB0C098625FBE47_10F47D053B284EB5F3ED5550578B001D","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8FE2C641C99CFA6687FA8D31B7D528A1","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D3BD78A30B98D17C317EDD4FFE850A0","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_77EB97F2E95D4980FAA5A3E040A0FF80","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZSOGGMMJ.txt","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZXGNCPDJ.txt","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\search[1].json","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_4344","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_10f8_IE_EarlyTabStart_0x1200_Mutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_10f8_ConnHashTable<4344>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"IsoScope_c54_IE_EarlyTabStart_0xd64_Mutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"IsoScope_c54_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3156","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"IsoScope_c54_ConnHashTable<3156>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"IsoScope_10f8_IE_EarlyTabStart_0x1200_Mutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"IsoScope_10f8_ConnHashTable<4344>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_4344","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c54_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3156","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c54_IE_EarlyTabStart_0xd64_Mutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c54_ConnHashTable<3156>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5ca5aacc028838a38544b9ef"}]}]}},"report_ids":{"sandbox_job_ids":["5ca5aacc028838a38544b9ef"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Generic Trojan.ai Sample f32f8ca082b5… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f32f8ca082b5…. Malware family: Generic Trojan.ai. Threat score 96/100. 0/0 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f32f8ca082b53db965eb91576c3566a7e0ad41f21c79a5a9b54c5be473d9aa5c"}],["$","meta","4",{"property":"og:title","content":"Malicious Generic Trojan.ai Sample f32f8ca082b5… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f32f8ca082b5…. Malware family: Generic Trojan.ai. Threat score 96/100. 0/0 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f32f8ca082b53db965eb91576c3566a7e0ad41f21c79a5a9b54c5be473d9aa5c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Generic Trojan.ai Sample f32f8ca082b5… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f32f8ca082b5…. Malware family: Generic Trojan.ai. Threat score 96/100. 0/0 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]