26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample fb0b78482341… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fb0b78482341…. Malware family: Trojan.Generic. Threat score 100/100. 19/29 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fb0b78482341c95b76a1f4579c19d0c9f73f72a078278e3a5c4d2ba5ceac9104","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","fb0b78482341c95b76a1f4579c19d0c9f73f72a078278e3a5c4d2ba5ceac9104"],"about":{"@type":"SoftwareApplication","name":"info.exe","applicationCategory":["peexe","executable"],"identifier":"fb0b78482341c95b76a1f4579c19d0c9f73f72a078278e3a5c4d2ba5ceac9104","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":29},"behavioralIndicators":{"malicious":8,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5c4,Spawned process "cmd.exe" with commandline "/c vssadmin.exe Delete Shadows /All /Quiet" (UID: 00057660-00002404) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} recoveryenabled No" (UID: 00057680-00000284) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00057697-00003328) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures" (UID: 00057710-00003284) Spawned process "bcdedit.exe" with commandline "/set {default} recoveryenabled No" (UID: 00057746-00002136) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP" (UID: 00057762-00002496) Spawned process "bcdedit.exe" with commandline "/set {default} bootstatuspolicy ignoreallfailures" (UID: 00057770-00003816) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00057823-00002148) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP" (UID: 00057826-00003764) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00057888-00002692) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00057890-00002712) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /TN Encrypter /TR %APPDATA%\info.exe" (UID: 00057929-00003484) Spawned process "schtasks.exe" with commandline "/Create /SC ONLOGON /TN EncrypterSt /TR %APPDATA%\info.exe" (UID: 00058020-00003532)28:T516,"" read file "C:\Users\%OSUSER%\Desktop\desktop.ini" "" read file "C:\Users\%OSUSER%\Videos\desktop.ini" "" read file "C:\Users\%OSUSER%\Searches\desktop.ini" "" read file "C:\Users\%OSUSER%\Saved Games\Microsoft Games\desktop.ini" "" read file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "" read file "C:\Users\%OSUSER%\Pictures\desktop.ini" "" read file "C:\Users\%OSUSER%\ntuser.ini" "" read file "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" "" read file "C:\Users\%OSUSER%\Music\desktop.ini" "" read file "C:\Users\Public\Videos\Sample Videos\desktop.ini" "" read file "C:\Users\Public\Recorded TV\desktop.ini" "" read file "C:\Users\Public\Videos\desktop.ini" "" read file "C:\Users\%OSUSER%\Links\desktop.ini" "" read file "C:\Users\%OSUSER%\Documents\desktop.ini" "" read file "C:\Users\Public\Pictures\Sample Pictures\desktop.ini" "" read file "C:\Users\%OSUSER%\Contacts\desktop.ini" "" read file "C:\Users\Public\Pictures\desktop.ini" "" read file "C:\Users\%OSUSER%\Favorites\Links for United States\desktop.ini"29:T7d4,"" opened "C:\Users\%OSUSER%\Videos\desktop.ini" with delete access "" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST" with delete access "" opened "C:\Program Files\Wireshark\ws.css" with delete access "" opened "C:\Users\%OSUSER%\Searches\desktop.ini" with delete access "" opened "C:\Program Files\Wireshark\wireshark.html" with delete access "" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\Users\%OSUSER%\Saved Games\Microsoft Games\desktop.ini" with delete access "" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm" with delete access "" opened "C:\Users\%OSUSER%\Saved Games\desktop.ini" with delete access "" opened "C:\Program Files\Wireshark\Wireshark.exe" with delete access "" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm" with delete access "" opened "C:\Program Files\Wireshark\wireshark-filter.html" with delete access "" opened "C:\Users\%OSUSER%\Pictures\desktop.ini" with delete access "" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll" with delete access "" opened "C:\Users\%OSUSER%\ntuser.ini" with delete access "" opened "C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "" opened "C:\Program Files\Wireshark\WinSparkle.dll" with delete access "" opened "C:\Recovery\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\Winre.wim" with delete access "" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml" with delete access "" opened "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" with delete access2a:T5ff,Spawned process "" (UID: 00056645-00000948) Spawned process "cmd.exe" with commandline "/c vssadmin.exe Delete Shadows /All /Quiet" (UID: 00057660-00002404) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} recoveryenabled No" (UID: 00057680-00000284) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00057697-00003328) Spawned process "cmd.exe" with commandline "/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures" (UID: 00057710-00003284) Spawned process "bcdedit.exe" with commandline "/set {default} recoveryenabled No" (UID: 00057746-00002136) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP" (UID: 00057762-00002496) Spawned process "bcdedit.exe" with commandline "/set {default} bootstatuspolicy ignoreallfailures" (UID: 00057770-00003816) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00057823-00002148) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP" (UID: 00057826-00003764) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00057888-00002692) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00057890-00002712) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /TN Encrypter /TR %APPDATA%\info.exe" (UID: 00057929-00003484) Spawned process "schtasks.exe" with commandline "/Create /SC ONLOGON /TN EncrypterSt /TR %APPDATA%\info.exe" (UID: 00058020-00003532)2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"fb0b78482341c95b76a1f4579c19d0c9f73f72a078278e3a5c4d2ba5ceac9104","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790503400220,"unified_at":"2026-09-27T10:03:20.220Z","metadata":{"hashes":{"sha256":"fb0b78482341c95b76a1f4579c19d0c9f73f72a078278e3a5c4d2ba5ceac9104","sha1":"15ae2304b3e18ffc447e3ead7931dbeff280e336","md5":"82b9da42e9eda08731ae21a2dde9c0d2","sha512":"a63f7256317a5e5f75264fff56b15efcf2eb0206ffb25ad3b2a80e9d7188108d6664e99363860461356d6f44ee1b6460c7acb6cf09ce6169b38277f364b9a1ed","ssdeep":"24576:HpylwY61YLmMwu+v+XF54SkSY2FowlwnW8GpH57N8aIcuMORIP0vbmqSxGbWcaOs:JBY61Am39+VvpY2+8YHnCwbGrVedkjL","ssdeep_chunks":["24576:HpylwY6","24576:pylwY61","24576:ylwY61Y","24576:lwY61YL","24576:wY61YLm","24576:Y61YLmM","24576:61YLmMw","24576:1YLmMwu","24576:YLmMwu+","24576:LmMwu+v","24576:mMwu+v+","24576:Mwu+v+X","24576:wu+v+XF","24576:u+v+XF5","24576:+v+XF54","24576:v+XF54S","24576:+XF54Sk","24576:XF54SkS","24576:F54SkSY","24576:54SkSY2","24576:4SkSY2F","24576:SkSY2Fo","24576:kSY2Fow","24576:SY2Fowl","24576:Y2Fowlw","24576:2Fowlwn","24576:FowlwnW","24576:owlwnW8","24576:wlwnW8G","24576:lwnW8Gp","24576:wnW8GpH","24576:nW8GpH5","24576:W8GpH57","24576:8GpH57N","24576:GpH57N8","24576:pH57N8a","24576:H57N8aI","24576:57N8aIc","24576:7N8aIcu","24576:N8aIcuM","24576:8aIcuMO","24576:aIcuMOR","24576:IcuMORI","24576:cuMORIP","24576:uMORIP0","24576:MORIP0v","24576:ORIP0vb","24576:RIP0vbm","24576:IP0vbmq","24576:P0vbmqS","24576:0vbmqSx","24576:vbmqSxG","24576:bmqSxGb","24576:mqSxGbW","24576:qSxGbWc","24576:SxGbWca","24576:xGbWcaO","24576:GbWcaOs","49152:HpylwY6","49152:pylwY61","49152:ylwY61Y","49152:lwY61YL","49152:wY61YLm","49152:Y61YLmM","49152:61YLmMw","49152:1YLmMwu","49152:YLmMwu+","49152:LmMwu+v","49152:mMwu+v+","49152:Mwu+v+X","49152:wu+v+XF","49152:u+v+XF5","49152:+v+XF54","49152:v+XF54S","49152:+XF54Sk","49152:XF54SkS","49152:F54SkSY","49152:54SkSY2","49152:4SkSY2F","49152:SkSY2Fo","49152:kSY2Fow","49152:SY2Fowl","49152:Y2Fowlw","49152:2Fowlwn","49152:FowlwnW","49152:owlwnW8","49152:wlwnW8G","49152:lwnW8Gp","49152:wnW8GpH","49152:nW8GpH5","49152:W8GpH57","49152:8GpH57N","49152:GpH57N8","49152:pH57N8a","49152:H57N8aI","49152:57N8aIc","49152:7N8aIcu","49152:N8aIcuM","49152:8aIcuMO","49152:aIcuMOR","49152:IcuMORI","49152:cuMORIP","49152:uMORIP0","49152:MORIP0v","49152:ORIP0vb","49152:RIP0vbm","49152:IP0vbmq","49152:P0vbmqS","49152:0vbmqSx","49152:vbmqSxG","49152:bmqSxGb","49152:mqSxGbW","49152:qSxGbWc","49152:SxGbWca","49152:xGbWcaO","49152:GbWcaOs","24576:JBY61Am","24576:BY61Am3","24576:Y61Am39","24576:61Am39+","24576:1Am39+V","24576:Am39+Vv","24576:m39+Vvp","24576:39+VvpY","24576:9+VvpY2","24576:+VvpY2+","24576:VvpY2+8","24576:vpY2+8Y","24576:pY2+8YH","24576:Y2+8YHn","24576:2+8YHnC","24576:+8YHnCw","24576:8YHnCwb","24576:YHnCwbG","24576:HnCwbGr","24576:nCwbGrV","24576:CwbGrVe","24576:wbGrVed","24576:bGrVedk","24576:GrVedkj","24576:rVedkjL"],"imphash":"baa93d47220682c04d92f7797d9224ce"},"file_info":{"file_name":"info.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1766400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1520494260000,"last_seen":1664745953000,"last_multi_scan":1664745953000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["dde","exploit","ransomware"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":21,"malicious_count":8,"total":46},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.TPM.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.Rapid.7B813850","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/SuspPack.GG.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.Rapid.7B813850 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.CLO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Themida","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0040f4ef1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TPM.eyshhu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.67B24506","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.67B24506","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.BKHB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.Win32.90355","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"WMIC.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\BleepingComputer_rapid\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"DBWinMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"BleepingComputer_rapid\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c vssadmin.exe Delete Shadows /All /Quiet\" on 2018-3-7.23:16:40.928\n \"/c bcdedit.exe /set {default} recoveryenabled No\" on 2018-3-7.23:16:41.128\n \"/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\" on 2018-3-7.23:16:41.519\n \"/c wbadmin DELETE SYSTEMSTATEBACKUP\" on 2018-3-7.23:17:22.080\n \"/c wmic SHADOWCOPY DELETE\" on 2018-3-7.23:17:22.580","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"OLLYDBG\"\n \"\" searching for class \"GBDYLLO\"\n \"\" searching for class \"pediy06\"\n \"\" searching for class \"18467-41\"\n \"\" searching for class \"FilemonClass\"\n \"\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\"\n \"\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\"\n \"\" searching for class \"Filemonclass\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"info.exe.bin\" (Offset: 1377237)","origin":"Binary File","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"Windows Media Player.lnk\" has type \"empty \"\n \"Sticky Notes.lnk\" has type \"empty \"\n \"Paint.lnk\" has type \"empty \"\n \"MineSweeper.lnk\" has type \"empty \"\n \"Calculator.lnk\" has type \"empty \"\n \"Adobe Reader XI.lnk\" has type \"data\"\n \"yZw6snqBQ28DAzu.exe\" has type \"data\"\n \"OfficeMUISet.msi\" has type \"data\"\n \"MineSweeper.lnk\" has type \"data\"\n \"uninstall.exe\" has type \"data\"\n \"PidGenX.dll\" has type \"data\"\n \"rRgk91Ih5n.doc\" has type \"data\"\n \"dwintl20.dll\" has type \"data\"\n \"WinSparkle.dll\" has type \"data\"\n \"DW20.EXE\" has type \"data\"\n \"Launch Internet Explorer Browser.lnk\" has type \"data\"\n \"WordMUI.msi\" has type \"data\"\n \"ShellUI.MST\" has type \"data\"\n \"Proof.msi\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\System32\\ntdll.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\oleaccrc.dll\"\n \"\" touched file \"%WINDIR%\\System32\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\propsys.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.sysinternals.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"WMIC.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"WMIC.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00057888-00002692)\n Process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00057890-00002712)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"\n \"wbadmin.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"WMIC.exe\" wrote bytes \"40532b7758582c77186a2c77653c2d770000000000bf7e750000000056cc7e75000000007cca7e7500000000376845756a2c2d77d62d2d7700000000206945750000000029a67e7500000000a48d457500000000f70e7e7500000000\" to virtual address \"0x773C1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"???\n ugivzfap with unusual entropies 7.98131457176\n 7.95423215599","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00056645-00000948-3341-5636-00218A30","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.bmp\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"$28","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%USERPROFILE%\\Videos\\How Recovery Files.txt\", Handle: 792)\n \"\" is creating a new process (Name: \"%USERPROFILE%\\Videos\\How Recovery Files.txt\", Handle: 696)\n \"\" is creating a new process (Name: \"%USERPROFILE%\\Videos\\How Recovery Files.txt\", Handle: 784)\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 804)\n \"\" is creating a new process (Name: \"%USERPROFILE%\\Videos\\How Recovery Files.txt\", Handle: 796)\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 784)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"/c bcdedit.exe /set {default} recoveryenabled No\" (UID: 00057680-00000284)\n Disables startup repair \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\" (UID: 00057746-00002136)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 71B20000","origin":"Loaded Module","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ENCRYPTER_074\"; Value: \"%APPDATA%\\info.exe\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"USERINFO\"; Value: \"%APPDATA%\\recovery.txt\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /TN Encrypter /TR %APPDATA%\\info.exe\" (UID: 00057929-00003484)\n Process \"schtasks.exe\" with commandline \"/Create /SC ONLOGON /TN EncrypterSt /TR %APPDATA%\\info.exe\" (UID: 00058020-00003532)","origin":"Monitored Target","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00057697-00003328)\n Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00057888-00002692)\n Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00057890-00002712)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"Hello, dear friend!All your files have been ENCRYPTEDDo you really want to restore your files?Write to our email - alexgen@cock.li or alexgen@tuta.ioand tell us your unique ID - ID-CMT9FHHA\" (Source: 00056645-00000948-0000018C-132741050, Indicator: \"files have been encrypted\")\n \"Hello, dear friend!All your files have been ENCRYPTEDDo you really want to restore your files?Write to our email - alexgen@cock.li or alexgen@tuta.ioand tell us your unique ID - ID-\" (Source: 3341-6035-00207D90, Indicator: \"files have been encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1075 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WMIC.exe\" (Indicator: \"wmic.exe\")\n \"root\\cimv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"info.exe.bin\" has an entrypoint in section \"fyfhoiza\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2a","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\info.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"23/67 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"23/67 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"malicious","category":"Installation/Persistance","name":"Creates a system file in windows directory","description":"\"\" created file \"%WINDIR%\\System32\\ntdll.dll\"","origin":"API Call","relevance":7,"id":"api-5","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\wbem\\WMIC.exe\" (Handle: 784)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\wbem\\WMIC.exe\" (Handle: 784)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\wbem\\WMIC.exe\" (Handle: 784)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Office_OLE_DDE\" classified file \"yZw6snqBQ28DAzu.exe\" as \"dde,exploit\" based on indicators: \"13644465fb0c75f541964addcff94dae091aa23bc832b55ad42bcbe747fc1c\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"recovery.txt\" which has been seen in the context of ransomware (Indicator: recovery.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the system/video BIOS version"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]}]},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":19,"imported_dlls_count":73,"dropped_files_count":0,"extracted_files_count":82,"files_written_count":112,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["dde","exploit","ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5aa0e27a7ca3e16b957b0123","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DeepScan:Generic.Ransom.Rapid","submit_name":"info.exe","analysis_start_time":"2018-03-08T08:13:49+00:00","indicators_count":{"informative":17,"suspicious":32,"malicious":9},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}],"processes":[{"pid":948,"ppid":0,"name":"info.exe","command_line":"","sha256":"fb0b78482341c95b76a1f4579c19d0c9f73f72a078278e3a5c4d2ba5ceac9104","normalized_path":"C:\\info.exe","uid":"00056645-00000948","icon":"$2b"},{"pid":2404,"ppid":948,"name":"cmd.exe","command_line":"/c vssadmin.exe Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00056645-00000948","uid":"00057660-00002404"},{"pid":3328,"ppid":2404,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00057660-00002404","uid":"00057697-00003328"},{"pid":284,"ppid":948,"name":"cmd.exe","command_line":"/c bcdedit.exe /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00056645-00000948","uid":"00057680-00000284"},{"pid":2136,"ppid":284,"name":"bcdedit.exe","command_line":"/set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00057680-00000284","uid":"00057746-00002136"},{"pid":3284,"ppid":948,"name":"cmd.exe","command_line":"/c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00056645-00000948","uid":"00057710-00003284"},{"pid":3816,"ppid":3284,"name":"bcdedit.exe","command_line":"/set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00057710-00003284","uid":"00057770-00003816"},{"pid":2496,"ppid":948,"name":"cmd.exe","command_line":"/c wbadmin DELETE SYSTEMSTATEBACKUP","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00056645-00000948","uid":"00057762-00002496"},{"pid":3764,"ppid":2496,"name":"wbadmin.exe","command_line":"wbadmin DELETE SYSTEMSTATEBACKUP","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","parent_uid":"00057762-00002496","uid":"00057826-00003764"},{"pid":2148,"ppid":948,"name":"cmd.exe","command_line":"/c wmic SHADOWCOPY DELETE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00056645-00000948","uid":"00057823-00002148"},{"pid":2712,"ppid":2148,"name":"WMIC.exe","command_line":"wmic SHADOWCOPY DELETE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00057823-00002148","uid":"00057890-00002712"},{"pid":2692,"ppid":948,"name":"WMIC.exe","command_line":"wmic SHADOWCOPY DELETE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00056645-00000948","uid":"00057888-00002692"},{"pid":3484,"ppid":948,"name":"schtasks.exe","command_line":"/Create /SC MINUTE /TN Encrypter /TR %APPDATA%\\info.exe","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00056645-00000948","uid":"00057929-00003484"},{"pid":3532,"ppid":948,"name":"schtasks.exe","command_line":"/Create /SC ONLOGON /TN EncrypterSt /TR %APPDATA%\\info.exe","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00056645-00000948","uid":"00058020-00003532"}],"all_imported_dlls":["profapi.dll","oleaccrc.dll","atl.dll","ws2_32.dll","wbemprox.dll","xmllite.dll","sechost.dll","psapi.dll","vsstrace.dll","wtsapi32.dll","kernel32.dll","KernelBase.dll","wininet.dll","winbrand.dll","clbcatq.dll","RpcRtRemote.dll","wbemcomn.dll","lpk.dll","imm32.dll","uxtheme.dll","setupapi.dll","ntdsapi.dll","urlmon.dll","ntmarta.dll","msxml3r.dll","comctl32.dll","propsys.dll","oleacc.dll","nsi.dll","wbemsvc.dll","msvcrt.dll","gdi32.dll","crypt32.dll","rpcss.dll","blbres.dll","fastprox.dll","msctf.dll","msasn1.dll","sspicli.dll","ieframe.dll","cryptsp.dll","ktmw32.dll","version.dll","ntdll.dll","shlwapi.dll","cryptbase.dll","rsaenh.dll","rpcrt4.dll","cfgmgr32.dll","vssapi.dll","vss_ps.dll","msvcr90.dll","advapi32.dll","usp10.dll","oleaut32.dll","slc.dll","IPHLPAPI.DLL","user32.dll","winmm.dll","devobj.dll","Wldap32.dll","credui.dll","msxml3.dll","MSOXMLMF.DLL","shell32.dll","apphelp.dll","framedynos.dll","secur32.dll","winnsi.dll","ole32.dll","dnsapi.dll","taskschd.dll","iertutil.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Calculator.lnk","sha256":"286f0af7af4b89b4999699585b57a836ad08226a26fb7baae5012aaeded28329","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"MineSweeper.lnk","sha256":"df7bda0e05dfdc4e2d52821c40688d3f1d4381971cad9213c043c6a21e53b3f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Paint.lnk","sha256":"345f95fcf2a544e192ee7eba35b26b6225ad8b9c5dcb93974fb3d6d57bf04ae3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Sticky Notes.lnk","sha256":"eef838880b7838ebdbaff9f1934c9306b95eefc11ff389ef483804c625540f94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Windows Media Player.lnk","sha256":"db7029e689d0a25d2b08c67e4434e69ec54cc0d4dfd09df0006c3f1c1cb5fb1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"recent","sha256":"3eb610fd103a90f5c5e2f10d49aaa9b1dab689d57b3375c98998388918de53d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"recent_common","sha256":"e59ead11061a5655ac9ff91cb01d139e91c917b2f3ad0526c3e0ce8ebd91a5d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"recovery.txt","sha256":"1054f2f4f552160a38f64ba5ce73a250d3f618c6543f8ebe1fc0a0db29de6bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"index.dat","sha256":"9dbaa71b1d57649abdf75b50981be5078964579e31212e4425c81f7aa7e49b1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"WinPcap_4_1_3.exe","sha256":"cbbf274c7ae1df66a96652598fcb8cfa7eef951f5968953ff2b9b6e88664aedc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"WinSparkle.dll","sha256":"3108440a891d3bb77a6abb571534850242eb3b3b3c0885b9d7ed0dbd57406fc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Wireshark.exe","sha256":"c70e68fa9a9faae473b6e2c41617f113aef1a7e5479782ccde51558623c7918b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"text2pcap.exe","sha256":"720cfeee6c9daabf51ffcffb1f3e110e8ba010541f6c3a546417f655a2eda233","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"text2pcap.html","sha256":"e5fc95978ff4248e8bb273381e5e5c43f8e68fb770b6c5d58853cab4ec707cd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"tpncp.dat","sha256":"9a5d3c1c391d868f4d1eabb753478add37ba342c323b4edba55715cf0a072df7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"tshark.html","sha256":"fe9d19ac3da34c97e4c806fe77938a832e66301b0e2a8e9a0f43306c0f9bfde8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"uninstall.exe","sha256":"e5b9f2f934391d0377c958d4572303be08e08e998a1a0bc3164c2d64956828ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"user-guide.chm","sha256":"9728ad8636c45b541baf13fc48321b983a34d258d154ec9dbcb4930e7af32b29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"dictionary.dtd","sha256":"8070b9dff326393b4e429ca873e6ea1f126bfb7666c96022c60a96b1c55297b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"dictionary.xml","sha256":"f87eaf3a3afbc3c50053de013704dce28f8f8b759934887c9f5165bd5230679b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"wireshark-filter.html","sha256":"222765cb159b941327f3930ff004c7723972941be3679c6015b9b243cee0147a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"wireshark.html","sha256":"6fbf4062778e2cb1ca2d474c14671ea9586182b792e9839f281ece31f0bcf0e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"ws.css","sha256":"2ff0b896fe1d3ef94af72c7aa8ad9396a8c1208dcd33c0f57f8301f71e3126e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"How Recovery Files.txt","sha256":"86fbd49293d070b0b4162f64f1a208445adfedad2e0c73bff0126ad9b4e3afe3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Sleep Away.mp3","sha256":"ed89f5b35026373c9202bcf054ed77c2dd6cd19b36f9bd332cdb7a94c9eb9c0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Desktop.lnk","sha256":"5614dd189a7a7d35b6f5011c5119386430def4d69cebd927b3206c391f9e2994","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Downloads.lnk","sha256":"24e8f2ebc12489469aa35ee82a6196878a140fc6322495e58106d48efc9c3c8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"RecentPlaces.lnk","sha256":"e747a667b538d7250a0efef1a5b1cc7d1d12a8816674e3e0ddd4f67600d1aea2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"DW20.EXE","sha256":"2e29569fe0ab0bd293d9d00cd30681bf2af08d891add8b2454f9c18dcbfa8204","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"OfficeMUI.msi","sha256":"9a2b8ad8ca27ebc4fd9038f032dea378c052781a1866610f6e5f426a7e60cd16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"OfficeMUISet.msi","sha256":"ff525eda9e81efc9e143863c419eff78e4ac2831305f53a4845b1493a4683971","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"ShellUI.MST","sha256":"cdc8d77fba02360ea38b520fda39a17ee4e303e69d74c8b1e3d9fc36d0f6d903","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"dwdcw20.dll","sha256":"5782ef15671e54e7865f1e9d9843d037417dab2e65c9729d2c107820b8a291ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"dwtrig20.exe","sha256":"9497f2a6a3a65016ad675191c1ff84e506207f172ecc923142eb03e1e85169ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"msvcr90.dll","sha256":"30a33b1f315c30941fe04388775c18cd554aa841de8b1e2eef266a1dea19774b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"osetupui.dll","sha256":"33e81b712b2e0f837aac9958582e2364ad168c9cf6338caa70098fe0e78de43f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"pss10r.chm","sha256":"44d8360b96b894967c739eb80d113330fb1d53f421bd571f56f6c5219c2b6f9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"setup.chm","sha256":"efc9c5b63f4d2d364f3b4faeba3cc3041db4ca55880488bc86028b2da6ace859","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"autoexec.bat","sha256":"3ecad93dcaca55350956a174e8a43a18e52a1608e2b20f0e3eee8f9c8e86f349","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Adobe Reader XI.lnk","sha256":"ac405471616bace32174c98729dd4ebbe7fb5a09c3159584e54620ee08605e99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"fb868bfe45203abc24fa88825fe70513b40961dc0466d791bb6a77ae8ac7bf5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"PidGenX.dll","sha256":"e5bbdbf80780be7568cf34a001fa292ff6f7f8987efd25727ff3a83f40aa87ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"rRgk91Ih5n.doc","sha256":"f74a1e22be63b3b78337eb1c177b6e538135d52014efe2a6f817fe76f02f75fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"dwintl20.dll","sha256":"de5f032ea3d814e9ab443725d7106ff6ffb4be42ec8b19d473b283c3f9391776","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Launch Internet Explorer Browser.lnk","sha256":"a331db84fb3ee18393bfa26da1fa3f9352b312a61d0c1f010caec4e5fdd156d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"WordMUI.msi","sha256":"3afeb0798b2b4eb01c2db5ad9940d46404b71cd9e541b75d3f8295d8ea47af26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Proof.msi","sha256":"7b7934ca039b7fcd3433c4c49d85b27be801f395f78019a63a3d4aa1a8516611","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"securitypack.jar","sha256":"8d3f6391fa85fb9f29bd7a7be589162c7818eeb6e51981d6119131bf4f3cbbf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"4ecf05181cc1374316272e79ae799c68a10b59c7e2cedab16320488de673b89b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Internet Explorer.lnk","sha256":"a2d3ca6d4aa667e45b296db0dab104b15304505a6c5a501eb28dbc66072af877","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Mozilla Firefox.lnk","sha256":"133481cbb8a56f6187e54fae7f1b1368c1edc682a728c970592c9141a4d6b0e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Google Chrome.lnk","sha256":"29dcac5eab2420d63935ee51e2e2d2454c76adfc0d72d09a0695b4ad7035a572","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"w5JaoO.doc","sha256":"796ac88e453504720e36d62841eb13554d2d3ddd8b282e76d1d8d95b7b259008","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"tDUzYwYK5f.exe","sha256":"6453ef48ea938d1114423c49fb8570d2f599c54f9ec69f919142e2b3d1d7d88d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"feb3b8fbe4808096c1eca4efb4015856c0a34dad240711cb2e286dbba0df2380","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"kY01UeAiy5.exe","sha256":"5018d5541397f661a355fcd5b87c2d2b28e7abb167e9feed344b39572a1c610a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Shows Desktop.lnk","sha256":"777a263740f1ff67938a8cf6290bcb7569e56967032cefe759d5abca8cb1fec2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"PublisherMUI.msi","sha256":"d607dd664cf0a7f39d4aaffa76fe9256fa03e4645d74f82d88759c304dadb0c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"hlchPBL.exe","sha256":"ba7892e852ad6c467f0a76e8d0ec50112283776dfc61c11d903d6a04f65043b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"OutlookMUI.msi","sha256":"7deb50e2fec8901a2081098588432dfda33c4c23ce4a383d2c6c592a0ac1d1ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Proofing.msi","sha256":"51be0e3a3de3bc931ec3a6fa1798c74d3fcb328fed336488792766e9079b6e6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"New Microsoft Word Document.LNK","sha256":"d75674e9c75e5219a87c21c093a07b9378866ade6b0bbee0f9ef76197ec0c591","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"pinned.lnk","sha256":"4b48da114bebe77e9640477e1885ceb3764ed48c074f439f765ed1177799b526","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Window Switcher.lnk","sha256":"3cf684b482b5829cdf1719df877f055232fa3e1466585706fb197f4c5672963f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"setup.exe","sha256":"3ba01e7b360742bb0557599853562f89224304f73aa35705ee1c8d58555de1a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"iLLOga.exe","sha256":"7d4e09569285f155a91e03f5a1ae5be2108aded2f9f406097ca9954ff1cd277f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"klmqz.doc","sha256":"81c463db0561bbba639eba4b8e8b8ba858e009c665595beaab6b6d77d5b1e16d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"PowerPointMUI.msi","sha256":"be25e8ec257991bbbe6f144f90750586bc186d2edb6ade7da19d5a27c4daf284","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"mtgFs8Za.doc","sha256":"a738119d0a9b511b3811cc3727d4dd32b7a518c073d2027805f15e7be0b7080b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"c9d8ef51bcebbfee3d409066dfc33651205355526e60e0ecde74d8e3f52defec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"hKY8.doc","sha256":"6b94812022cc87a0b8e333c1e07b489f0a584b0b52d9524f88e725774217692f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"OneNoteMUI.msi","sha256":"56f11413ee99303a6c930a5be536549b4fbca1d9d8beee9bbe820de9a85d76e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Windows Explorer.lnk","sha256":"16d39e1427bc945680b5051aead3468574bc9005c922f9584f626a6298183830","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Templates.LNK","sha256":"d03892683e6b6dba1ae0592b4fda6bde49dd175672b86292498c5c2d9f1c5c2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Office64WW.msi","sha256":"42b11ada55a0b6441cde46b782a90ea98c65a20375459590d89446687a826cf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"ose.exe","sha256":"afbb760816f8ef9406c5d90c09a81aa21b27026a2afd96d6df246ac9b45a39a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"ExcelMUI.msi","sha256":"00b11915aa95115372eca32396ab56398f9d240016b721d9ea19b58fe0017044","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"NormalOld.dotm","sha256":"ea829c5b1dcf38b7d2f1011cae6667e9663b9d2f639159e5dc08a06e0e6699be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"TM01840907[[fn=Equations]].dotx","sha256":"fcd2c24644124d94968b77e38881fa50d22486ab86ab09024a8d8bdbdbcc3cd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Normal.dotm","sha256":"db292d1d49c3dc1e3eb4d1ec3e2d7ca2d998e8c5e5d9299ef2bc414e3547ebf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Building Blocks.dotx","sha256":"20f393473578036af0ec2f3eae46407b903484a8daa124029373347cad33f7e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Built-In Building Blocks.dotx","sha256":"9a08c84554f7663bf652b9adab00acbb940049f7bb692d399f2928e094006b68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]}],"files_written":[{"path":"%WINDIR%\\System32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\wbadmin.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\wbem","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\en-US\\wbadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\Logs","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\schtasks.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\blbres.dll","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\en-US\\blbres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.3.etl","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.2.etl","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.1.etl","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\info.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%APPDATA%\\info.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\info.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%APPDATA%\\info.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%APPDATA%\\recovery.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\share\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Videos\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\Recovery\\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PROGRAMFILES%\\Wireshark\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\share\\1520493266353$OK","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\share\\1520493266353$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PROGRAMFILES%\\Wireshark\\zlib1.dll","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Templates","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\SendTo","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PROGRAMFILES%\\Wireshark\\wiretap-1.12.0.dll","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Searches\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Searches\\Everywhere.search-ms","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Saved Games\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Recent","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\PrintHood","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Pictures\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\NetHood","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\My Documents","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Music\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PUBLIC%\\Recorded TV\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Local Settings","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Links\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PROGRAMFILES%\\Wireshark\\wimaxasncp\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PUBLIC%\\Videos\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Documents\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Documents\\My Videos","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Documents\\My Pictures","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Documents\\My Music","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Desktop\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Downloads\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Cookies","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Contacts\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PROGRAMFILES%\\Wireshark\\tshark.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PROGRAMFILES%\\Wireshark\\tpncp\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PUBLIC%\\Pictures\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Application Data","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%APPDATA%\\Wireshark\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%USERPROFILE%\\Downloads\\zqpeyi.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%APPDATA%\\How Recovery Files.txt","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Sleep Away.mp3","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"path":"%PROGRAMFILES%\\Wireshark\\text2pcap.exe","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\BleepingComputer_rapid","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"BleepingComputer_rapid","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!2izihaf!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!2izihaf!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!2izihaf!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5aa0e27a7ca3e16b957b0123"}]}]}},"report_ids":{"sandbox_job_ids":["5aa0e27a7ca3e16b957b0123"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample fb0b78482341… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fb0b78482341…. Malware family: Trojan.Generic. Threat score 100/100. 19/29 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fb0b78482341c95b76a1f4579c19d0c9f73f72a078278e3a5c4d2ba5ceac9104"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample fb0b78482341… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fb0b78482341…. Malware family: Trojan.Generic. Threat score 100/100. 19/29 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fb0b78482341c95b76a1f4579c19d0c9f73f72a078278e3a5c4d2ba5ceac9104"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample fb0b78482341… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fb0b78482341…. Malware family: Trojan.Generic. Threat score 100/100. 19/29 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]