24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.A095D3DB Sample 73a10be31832… — Score 75/100 — Hybrid Analysis","description":"Malicious verdict for sample 73a10be31832…. Malware family: Ransom.A095D3DB. Threat score 75/100. 18/28 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79","keywords":["Malicious","Ransom.A095D3DB","malware analysis","sandbox report","threat intelligence","73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79"],"about":{"@type":"SoftwareApplication","name":"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79","applicationCategory":["peexe","executable"],"identifier":"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79","additionalType":"Malicious sample"},"threatScore":75,"malwareFamily":"Ransom.A095D3DB","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8f4,Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Active Directory Toplogy"" (UID: 00137031-00003576) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Anti-spam Update"" (UID: 00137033-00002976) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Audit"" (UID: 00137034-00003872) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Service"" (UID: 00137035-00003272) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange DAG Management"" (UID: 00137036-00002488) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Diagnostics"" (UID: 00137037-00001984) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange EdgeSync"" (UID: 00137038-00003864) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Frontend Transport"" (UID: 00137039-00002644) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager"" (UID: 00137046-00001112) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager Recovery"" (UID: 00137047-00001252) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4"" (UID: 00137051-00003904) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4 Backend"" (UID: 00137052-00003108) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Information Store"" (UID: 00137055-00004012) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Assistants"" (UID: 00137057-00001452) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Replication"" (UID: 00137075-00002256) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Transport Delivery"" (UID: 00137081-00002336) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3"" (UID: 00137086-00002920) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3 Backend"" (UID: 00137088-00001420) Spawned process "sc.exe" with commandline "sc stop "SQL Server Agent (TESTINSTANCE)"" (UID: 00137094-00001268) Spawned process "sc.exe" with commandline "sc stop "SQL Server (TESTINSTANCE)"" (UID: 00137098-00002148)26:T8f4,Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Active Directory Toplogy"" (UID: 00137031-00003576) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Anti-spam Update"" (UID: 00137033-00002976) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Audit"" (UID: 00137034-00003872) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Service"" (UID: 00137035-00003272) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange DAG Management"" (UID: 00137036-00002488) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Diagnostics"" (UID: 00137037-00001984) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange EdgeSync"" (UID: 00137038-00003864) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Frontend Transport"" (UID: 00137039-00002644) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager"" (UID: 00137046-00001112) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager Recovery"" (UID: 00137047-00001252) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4"" (UID: 00137051-00003904) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4 Backend"" (UID: 00137052-00003108) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Information Store"" (UID: 00137055-00004012) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Assistants"" (UID: 00137057-00001452) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Replication"" (UID: 00137075-00002256) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Transport Delivery"" (UID: 00137081-00002336) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3"" (UID: 00137086-00002920) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3 Backend"" (UID: 00137088-00001420) Spawned process "sc.exe" with commandline "sc stop "SQL Server Agent (TESTINSTANCE)"" (UID: 00137094-00001268) Spawned process "sc.exe" with commandline "sc stop "SQL Server (TESTINSTANCE)"" (UID: 00137098-00002148)27:T732,".exe" opened "C:\Users\AFmkP5c\Downloads\8DUQ1mebDrpcsmG.txt" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\8EiaFDlB4M.txt" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\8UnnC3Z1ObogIu.txt" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\8zga0cfP9YM41Ym.gif" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\91ofmXRFtTW4.rar" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\97aENWJbeKBn2.pdf" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\9C7DD5h4CqeNmZHy.jpg" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\9GoGcenZ.img" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\A80f.doc" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\aB0w3q25YAx.rar" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\AHiFpXlk.img" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\AJaiC.rar" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\AJfPt5.gif" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\alCR7Vz.pdf" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\AMrt2OL.exe" with delete access ".exe" opened "C:\Program Files\Wireshark\libgio-2.0-0.dll" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\ancpyWMibIM3tcgy.doc" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\aoVwPqh5K.avi" with delete access ".exe" opened "C:\Program Files\Wireshark\NEWS.txt" with delete access ".exe" opened "C:\Users\AFmkP5c\Downloads\ara0UGGW3VRU.exe" with delete access28:T933,Spawned process ".exe" (UID: 00136717-00000856) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Active Directory Toplogy"" (UID: 00137031-00003576) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Anti-spam Update"" (UID: 00137033-00002976) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Audit"" (UID: 00137034-00003872) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Service"" (UID: 00137035-00003272) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange DAG Management"" (UID: 00137036-00002488) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Diagnostics"" (UID: 00137037-00001984) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange EdgeSync"" (UID: 00137038-00003864) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Frontend Transport"" (UID: 00137039-00002644) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager"" (UID: 00137046-00001112) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager Recovery"" (UID: 00137047-00001252) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4"" (UID: 00137051-00003904) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4 Backend"" (UID: 00137052-00003108) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Information Store"" (UID: 00137055-00004012) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Assistants"" (UID: 00137057-00001452) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Replication"" (UID: 00137075-00002256) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Transport Delivery"" (UID: 00137081-00002336) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3"" (UID: 00137086-00002920) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3 Backend"" (UID: 00137088-00001420) Spawned process "sc.exe" with commandline "sc stop "SQL Server Agent (TESTINSTANCE)"" (UID: 00137094-00001268) Spawned process "sc.exe" with commandline "sc stop "SQL Server (TESTINSTANCE)"" (UID: 00137098-00002148)29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":75,"unified_at_epoch_ms":1791491055261,"unified_at":"2026-10-08T20:24:15.261Z","metadata":{"hashes":{"sha256":"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79","sha1":"800c8a12ac05459197256940e32234b9bc2db08b","md5":"ccc6026acf7eadada9adaccab70ca4d6","sha512":"355cb4beb4aa7d4b5d8dca1220a8de5d9329fa13c3a3f8f7ed38e1501a098a3d7f18f30565c6acaba62917cbb027b869208b1e902f992257678a20bac886ec10","ssdeep":"98304:ClRpXQKzpWzW64H1zYZAkdfcb0S4DbZGVz3qS0wcQ538AfprYKd0b0shkC:KZYpAk5uVDwwcosAfJYKdtshkC","ssdeep_chunks":["98304:ClRpXQK","98304:lRpXQKz","98304:RpXQKzp","98304:pXQKzpW","98304:XQKzpWz","98304:QKzpWzW","98304:KzpWzW6","98304:zpWzW64","98304:pWzW64H","98304:WzW64H1","98304:zW64H1z","98304:W64H1zY","98304:64H1zYZ","98304:4H1zYZA","98304:H1zYZAk","98304:1zYZAkd","98304:zYZAkdf","98304:YZAkdfc","98304:ZAkdfcb","98304:Akdfcb0","98304:kdfcb0S","98304:dfcb0S4","98304:fcb0S4D","98304:cb0S4Db","98304:b0S4DbZ","98304:0S4DbZG","98304:S4DbZGV","98304:4DbZGVz","98304:DbZGVz3","98304:bZGVz3q","98304:ZGVz3qS","98304:GVz3qS0","98304:Vz3qS0w","98304:z3qS0wc","98304:3qS0wcQ","98304:qS0wcQ5","98304:S0wcQ53","98304:0wcQ538","98304:wcQ538A","98304:cQ538Af","98304:Q538Afp","98304:538Afpr","98304:38AfprY","98304:8AfprYK","98304:AfprYKd","98304:fprYKd0","98304:prYKd0b","98304:rYKd0b0","98304:YKd0b0s","98304:Kd0b0sh","98304:d0b0shk","98304:0b0shkC","196608:ClRpXQK","196608:lRpXQKz","196608:RpXQKzp","196608:pXQKzpW","196608:XQKzpWz","196608:QKzpWzW","196608:KzpWzW6","196608:zpWzW64","196608:pWzW64H","196608:WzW64H1","196608:zW64H1z","196608:W64H1zY","196608:64H1zYZ","196608:4H1zYZA","196608:H1zYZAk","196608:1zYZAkd","196608:zYZAkdf","196608:YZAkdfc","196608:ZAkdfcb","196608:Akdfcb0","196608:kdfcb0S","196608:dfcb0S4","196608:fcb0S4D","196608:cb0S4Db","196608:b0S4DbZ","196608:0S4DbZG","196608:S4DbZGV","196608:4DbZGVz","196608:DbZGVz3","196608:bZGVz3q","196608:ZGVz3qS","196608:GVz3qS0","196608:Vz3qS0w","196608:z3qS0wc","196608:3qS0wcQ","196608:qS0wcQ5","196608:S0wcQ53","196608:0wcQ538","196608:wcQ538A","196608:cQ538Af","196608:Q538Afp","196608:538Afpr","196608:38AfprY","196608:8AfprYK","196608:AfprYKd","196608:fprYKd0","196608:prYKd0b","196608:rYKd0b0","196608:YKd0b0s","196608:Kd0b0sh","196608:d0b0shk","196608:0b0shkC","98304:KZYpAk5","98304:ZYpAk5u","98304:YpAk5uV","98304:pAk5uVD","98304:Ak5uVDw","98304:k5uVDww","98304:5uVDwwc","98304:uVDwwco","98304:VDwwcos","98304:DwwcosA","98304:wwcosAf","98304:wcosAfJ","98304:cosAfJY","98304:osAfJYK","98304:sAfJYKd","98304:AfJYKdt","98304:fJYKdts","98304:JYKdtsh","98304:YKdtshk","98304:KdtshkC"],"imphash":"276d0afef3aba59d6ed944c60fb79e07"},"file_info":{"file_name":"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5566468,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1596015006000,"last_seen":1682692829000,"last_multi_scan":1682692829000}},"detections":{"summary":{"verdict":"malicious","score":75,"tags":["evasive"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":11,"suspicious_count":11,"malicious_count":5,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.CDJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.JKJL-5517","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.CDJ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.VMProtect.NAK suspicious application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Agent.awod","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXKA-YK!CCC6026ACF7E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Gen.ccmw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.VHD.5566468","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.A095D3DB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.A095D3DB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.CBW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.1308374","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.A095D3DB","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".text\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".vmp0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\AEEAEE SET\"\n \"AEEAEE SET\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Copy/Move/Rename/Delete/Link Object\" (Path: \"HKCU\\CLSID\\{3AD05575-8857-4850-9277-11B85BDB8E09}\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \".exe\" touched \"Recycle Bin\" (Path: \"HKCU\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\DEFAULTICON\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$25","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79.bin\" (Offset: 1875030)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"updater.exe\" has type \"data\"\n \"libwscodecs.dll\" has type \"data\"\n \"autoexec.bat\" has type \"PGP\\011Secret Key -\"\n \"libEGL.dll\" has type \"data\"\n \"nss3.dll\" has type \"data\"\n \"CCEnhancer-4.5.1.exe\" has type \"PGP\\011Secret Sub-key -\"\n \"libspandsp-2.dll\" has type \"data\"\n \"1LoWM7zNlVq8h.exe\" has type \"data\"\n \"api-ms-win-core-handle-l1-1-0.dll\" has type \"data\"\n \"rpcapd.exe\" has type \"data\"\n \"Qt5Multimedia.dll\" has type \"data\"\n \"Qt5Gui.dll\" has type \"data\"\n \"3TXw.exe\" has type \"data\"\n \"api-ms-win-core-processenvironment-l1-1-0.dll\" has type \"data\"\n \"api-ms-win-crt-utility-l1-1-0.dll\" has type \"data\"\n \"capinfos.exe\" has type \"data\"\n \"api-ms-win-core-debug-l1-1-0.dll\" has type \"data\"\n \"uninstall.exe\" has type \"data\"\n \"WinSparkle.dll\" has type \"data\"\n \"pingsender.exe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\"\n \"sc.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"sc.exe\" touched file \"%WINDIR%\\System32\\en-US\\sc.exe.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79.bin\" was detected as \"VMProtect v1.70.4-> phpbb3\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00136717-00000856-00000105-8369665987064378","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".vmp1 with unusual entropies 7.95614122708","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\sc.exe\", Handle: 172)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\sc.exe\", Handle: 168)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"NtProtectVirtualMemory@NTDLL.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79.bin\" claimed CRC 5611926 while the actual is CRC 5580364","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79.bin\" has an entrypoint in section \".vmp1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"Sleep\n GetModuleHandleA\n GetModuleFileNameW\n GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"e9db5ad377\" to virtual address \"0x00070005\" (part of module \"IMM32.DLL\")\n \".exe\" wrote bytes \"ff2515000700\" to virtual address \"0x0007000F\" (part of module \"IMM32.DLL\")\n \".exe\" wrote bytes \"e92aa52c88\" to virtual address \"0x77DA5AE0\" (\"NtProtectVirtualMemory@NTDLL.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"malicious","category":"Environment Awareness","name":"PE file is protected by VMProtect","description":"\"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79.bin\" has a section named \".vmp0\"\n \"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79.bin\" has a section named \".vmp1\"","origin":"Static Parser","relevance":7,"id":"static-74","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%USERPROFILE%\\Downloads\\CQR0Rz.gif\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 172)\n \".exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 172)\n \".exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 172)\n \".exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 168)\n \".exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 168)\n \".exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 168)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"HowToDecrypt.txt\" which has been seen in the context of ransomware (Indicator: DECRYPT.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$28","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a known ransomware file"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"PE file is protected by VMProtect"}],"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]}]},"activity":{"stats":{"process_count":21,"spawned_processes_count":21,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":31,"dropped_files_count":0,"extracted_files_count":145,"files_written_count":146,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5f213e37855ab447c221f8ff","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":75,"submit_name":"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79","analysis_start_time":"2020-07-29T09:20:08+00:00","indicators_count":{"informative":11,"suspicious":14,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}],"processes":[{"pid":856,"ppid":0,"name":"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79.exe","command_line":"","sha256":"73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79","normalized_path":"C:\\73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79.exe","uid":"00136717-00000856","icon":"$29"},{"pid":3576,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Active Directory Toplogy\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137031-00003576"},{"pid":2976,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Anti-spam Update\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137033-00002976"},{"pid":3872,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Compliance Audit\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137034-00003872"},{"pid":3272,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Compliance Service\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137035-00003272"},{"pid":2488,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange DAG Management\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137036-00002488"},{"pid":1984,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Diagnostics\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137037-00001984"},{"pid":3864,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange EdgeSync\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137038-00003864"},{"pid":2644,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Frontend Transport\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137039-00002644"},{"pid":1112,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Health Manager\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137046-00001112"},{"pid":1252,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Health Manager Recovery\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137047-00001252"},{"pid":3904,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange IMAP4\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137051-00003904"},{"pid":3108,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange IMAP4 Backend\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137052-00003108"},{"pid":4012,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Information Store\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137055-00004012"},{"pid":1452,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Mailbox Assistants\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137057-00001452"},{"pid":2256,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Mailbox Replication\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137075-00002256"},{"pid":2336,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Mailbox Transport Delivery\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137081-00002336"},{"pid":2920,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange POP3\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137086-00002920"},{"pid":1420,"ppid":856,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange POP3 Backend\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137088-00001420"},{"pid":1268,"ppid":856,"name":"sc.exe","command_line":"sc stop \"SQL Server Agent (TESTINSTANCE)\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137094-00001268"},{"pid":2148,"ppid":856,"name":"sc.exe","command_line":"sc stop \"SQL Server (TESTINSTANCE)\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00136717-00000856","uid":"00137098-00002148"}],"all_imported_dlls":["ole32.dll","clbcatq.dll","ntdll.dll","ntmarta.dll","lpk.dll","rpcss.dll","msvcrt.dll","shlwapi.dll","imm32.dll","msctf.dll","sechost.dll","shell32.dll","rpcrt4.dll","uxtheme.dll","KernelBase.dll","gdi32.dll","advapi32.dll","cryptbase.dll","propsys.dll","setupapi.dll","kernel32.dll","usp10.dll","profapi.dll","Wldap32.dll","cfgmgr32.dll","devobj.dll","user32.dll","oleaut32.dll","wtsapi32.dll","comctl32.dll","apphelp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"kmsauto.ini","sha256":"9f53d5e3071ea6bb551a95e7bf0f3b8beb3b661f38edc90f7415012745d0069b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Hx.hxn","sha256":"b9e9230d016addafefaf90719453bb214b673ff624a142cf3f9a90b196e72069","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Hx_1033_MKWD_K.HxW","sha256":"405fe97a8f0d00e54c6a319a827e907ee9a5e29e8536b45e881e53249163bebd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Hx_1033_MKWD_NamedURL.HxW","sha256":"9849bc39d0d341ca54a35299f0aca6f06a04ba17959b5e0506c79a018cbd5c71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Hx_1033_MTOC_Hx.HxH","sha256":"1e443fd686f6df1c526b5a553e9df61c417b2be76bf3b617d5a07c556c0c3d7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Hx_1033_MValidator.HxD","sha256":"1928ecf45caf26a29bd22b9a1ded6fc7d1d1b0d1d94bf56b62ea9497eb0d7943","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Hx_1033_MValidator.Lck","sha256":"4b4ecd915c106cfe289d10076548332c329b91bd1b4dbdc3d5594cdf75269016","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.EXCEL.14.1033.hxn","sha256":"db21736232e0f23198db7f85d9e573b2ac8aca7a887996a69ae60fe8e2d445d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.EXCEL.DEV.14.1033.hxn","sha256":"9d58dc49d31086a8a30e20e1e8e3aaa1870c792b584b126a7f7658b77acd643b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.GRAPH.14.1033.hxn","sha256":"993c6c67d31e37ad8da20fd6753ff9e5167646bac47fb6a0480adbbc64c6c994","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.MSOUC.14.1033.hxn","sha256":"564a0a79fc85ec5ef778444df505ea6c55bfd1fddb174bf0711b9cc59240b3b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.MSPUB.14.1033.hxn","sha256":"59d7d9e8e96fc8853f04caee316180ab947f28f7704582090fe6d23294c0b5bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.MSPUB.DEV.14.1033.hxn","sha256":"2b7db1308bdf3ac2878cdfd2458bd20c0a6f837453c584e29ecea9db0181eed8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.MSTORE.14.1033.hxn","sha256":"d4abffb34d4dd8a269c99cf6a30fd3a972480d18251d5443ee52aaaeaa2e8fc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.OIS.14.1033.hxn","sha256":"accafacf2752b3c475f3c1058fe233eb2ca583d6b673e4079f2e470fb46a2b7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.ONENOTE.14.1033.hxn","sha256":"43200cd90ab98effc508ea97487152c96fc0e7e64fe3508db9679ecc53f7d38a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.OUTLOOK.14.1033.hxn","sha256":"ada987d9ab8c487aa69fdde5d893269d06855b6f4c3a90de06d4b9524b96921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.OUTLOOK.DEV.14.1033.hxn","sha256":"4f921ed7370038c03b19091a8812b93d8819f982d266584c885d143f4919990a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.POWERPNT.14.1033.hxn","sha256":"42e63874df803482d8c4b22cf93b40e03e8a75ab8b9f9abe6ba3dc7d55ce435c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"MS.POWERPNT.DEV.14.1033.hxn","sha256":"32f9ae51bebea50f83d187f24a4f9571b04a1f1f288de3701c0d8e5b9866a95b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"7-zip.chm","sha256":"3c58ae68dbbc9758f05383a430919c0acdd3d599218f33e2c1d472c713399d5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"7z.dll","sha256":"4cbd9d2a04ff073ed9169c445f1d1cc104a0d92cc2d12f286b9399f8736c6fa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"7z.exe","sha256":"1f5c8ea6c588633580af02e868a0b4cbe89fce6e99ee05574c89fc08fc17f6fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"7zFM.exe","sha256":"ee694607a9c2c50b48d67da3a83379112287d0701dfa7bd5b1a5097caa53a07b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"7zG.exe","sha256":"5b3acbcc02ababd3d59d7506f9db2d6ba3bb734744b897821dc49c8af393f239","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Uninstall.exe","sha256":"60c2012a7b7582ecc3a5a14a6dfbff3245e7207d02e0aaa32b4144fae4c6913b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Au3Check.exe","sha256":"fdc736110848209ba830b820944bfe95706964e6821d7a0efd2afceb46fe11d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Au3Info.exe","sha256":"0b4ea429380b1e1cf59afd7c7a8023022d5ebd8c971a1614197e694a6aa4c990","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Au3Info_x64.exe","sha256":"5f7e750803dd3e148bbca5ff59177327d723d29e15bf825447fa90eff3ee7a84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"AutoIt3Help.exe","sha256":"f89994cefce4c0e4451991978f6e06277cb4292e5821195a51fa9060dd7b826d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"AutoIt3_x64.exe","sha256":"7c44e09d847a07086c4ce74b750c4150e57f870125e4568ea5075b9c7a3a771d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"CCEnhancer-4.5.1.exe","sha256":"4bb6a65622bcaeb4bb4d387b7730b34fb11713f1d7eaeb92f36ec1b86aadfaac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"sllauncher.exe","sha256":"9121943ebef696e0bea8246a1c9848f83a5634aab7e5838e16c6f7f75d957c74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"xapauthenticodesip.dll","sha256":"65299d22de02d78c5cf139b7727a5fa681182213beb19aba3ce21bb81f05fc61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"AccessibleHandler.dll","sha256":"4b36f2684bbcb9bad61a92d1b306095c1e09a0df4bfd54037eaa94c8ede90927","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"AccessibleMarshal.dll","sha256":"66bd9d8ca3a76cbc835e18c057f7413f9b8689b24202a12da6c931f7c9d10d2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"IA2Marshal.dll","sha256":"409a6a2c210dd301f21a1160312f37b7f964b0f8d156a6875d073220e73e2969","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-console-l1-1-0.dll","sha256":"f09cac4626ecbe0be67a960e843e71fa55f45d3f9e6f4c7494adfe6e41786304","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-datetime-l1-1-0.dll","sha256":"be9a51de944877648f67c9ead798cc9eeba6a14532ed4d075708b708ae91f8e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-debug-l1-1-0.dll","sha256":"41fc11d59315b87f9336fcca9aa82f57ede9c405d07af3f0f98ec033768d9f9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-errorhandling-l1-1-0.dll","sha256":"891be328669990fc5a55da5c1cf010f69e83f5dcceb995a4cc2d1c34a509be4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-file-l1-1-0.dll","sha256":"c751d04fbea10053530c5669284fc99797e41783fd4d3f0260af58def4dfefa2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-file-l1-2-0.dll","sha256":"fd6d49214849f16e7f761c20ee2584879aec6ad0b149464e982b59cef9b88bcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-file-l2-1-0.dll","sha256":"a7a80e4ed215597cd7bf9f93b446f224b4f8e15966418f4ce7c43648f16c5cbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-handle-l1-1-0.dll","sha256":"54b4ba0edc42381066d386ed255141dcee5f116b6679d725815fbb0c3ed6784b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-heap-l1-1-0.dll","sha256":"da2eae29b9294a520e6bb7399c8b8747eb654ad6e9f82230ce61fdfc52bb5923","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-interlocked-l1-1-0.dll","sha256":"bdab217c7a9534222b5e8126029874c8e4f1b80f2805c3c800adb3f0ab3db918","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-libraryloader-l1-1-0.dll","sha256":"cdf5486c72aa4539812aea5269035a9480625489b1b5b4707c0ad6221a766103","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"6d6c535de8e9c3e56f1052d04a7cf7899b86081886bf3859bb0cacf931917097","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-memory-l1-1-0.dll","sha256":"1666866af45c9792a78577cd9c9d690170ba46b12d1a12b98854803503533369","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-namedpipe-l1-1-0.dll","sha256":"32a7005a4c95f577e2de4c7332e526b48cac8cc293c8093764e648ef85333ab5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-processenvironment-l1-1-0.dll","sha256":"98d2e4ba7d072d0ff30d2e7d4609dd010eae166555281f9aa35e6dacaf4ccdcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-processthreads-l1-1-0.dll","sha256":"b69f3516fab2fe60d9fc23dafd95dd42ef69431316c1ced5ef6a90fa559c7688","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-processthreads-l1-1-1.dll","sha256":"669c803e2010b8f6b4cdc841cb544059c993e6f57a3509400a61fa8c2dc7c00a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-profile-l1-1-0.dll","sha256":"85901e7a8021e4cfdffa1d39963746ad0c0139ac30b461bbb36d045800fa8245","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-rtlsupport-l1-1-0.dll","sha256":"c496606fe836af47ffe17e0d6108cbfb2cb434f6ac7930b851109e4c107da923","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-string-l1-1-0.dll","sha256":"69392f53a15108d93779e06f6337f1dbd9db04fa57673b94c611c50d01b6fc13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-synch-l1-1-0.dll","sha256":"2e82160f74e1c6c5c597d50a9afd0244b282794e72185167af383a58b700dd66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-synch-l1-2-0.dll","sha256":"35ea805ffabc9bcfea93153adb66d8341e34e36adced99eaa4fb724128aebdbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-sysinfo-l1-1-0.dll","sha256":"5bcd096b4ec012cca2b615b1084d826df95ba98a698885b83c707a976e894f6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-timezone-l1-1-0.dll","sha256":"6d1d5e7832fa3a8df7db801a44af2b6ddb1b44b4f918c503397fa0453c37bf23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-core-util-l1-1-0.dll","sha256":"131a0265546c3d4ea7b27b7d921781fc0e06210a130c900a24fd31b2c293c60a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-conio-l1-1-0.dll","sha256":"c70884d7a2d957de966236dd3a2c09793eaef7c8efd7caa5ec7549b9b15a659a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"9aefd60c4c1f53a854f0716a6c4cd00ae053eeab3120a43c2ab1af3af0498cdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"033d38dc30060e0c0acf7466c8d736af42b77fb3f13594208ec3735c101d961e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"54ec881d5c0e3b90976f6ffe9dbbea27d8d97f9c69ec579d989d05893ab6ffc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"ebc4aeb49c50e1d8921e3c86910419320b04f7863a2ca8428db848b26ee03e35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"f9e247f4c334822c017485c667a58ff27c6c3281455a6f8b85673afe8ced1615","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"421432dc8d6e4dd45cd6c9997afec85f68bbf96e6b2260df98973c0c101632c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-multibyte-l1-1-0.dll","sha256":"c656d9464bf8f56e1c030e0d84cb4999b4b7933a2a8a36f4262d1a664eb60e23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-private-l1-1-0.dll","sha256":"37aa620ba213d087c5f416e7a8a6f615a842cab04cbf7143064a87aa0514d458","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-process-l1-1-0.dll","sha256":"75baf274ba6daa6cbc6b6b78b615f7a0edc5b0bdb13a3bc59c089ae4fb9aeccc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"62c4d1956ea3da0c48c577b0e30492a1bafb243436c803e7e74fea1ad7b9327e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"d126465b2336ef9bf992802a8c9c36121b81848a1cecc53c52b845d1d1b750db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"832ae3a4a6957e083b6d7c5a4a13d664c8b196225b20ff687b33a19e2802b51d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"c786eec32ab26cbcc78cd6fb6e5915608135c91a4ab05627572eac73f234e9d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"66b1bb4cdfa85e08de872c01e098934df11600a3ca5a7b670bb8c660831241cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"breakpadinjector.dll","sha256":"3997247e8faaaba7697d51964c7934971a5fee9782af1f70438e95e74afbe606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"crashreporter.exe","sha256":"29c07af499011bc9fb4b02417311e5537cb0697b72bf5b9df07dd3df2d462024","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"d3dcompiler_47.dll","sha256":"d409b80014b73f42013af17ae159c6cd5e99921294542be1c4052b479458ce05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"firefox.exe","sha256":"1ba10d274a2375479a369888b165ed8564249debb17dbd6c1a4a9ad046183c18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"freebl3.dll","sha256":"5f9e9fc60bb836226533e7c4e79a086120f9ef85ce6727c7c9e74c8012396643","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"lgpllibs.dll","sha256":"5cb167758577c12a250bbd3e564bd0f394cdfd28cbcae4b2dad6ec1c78201261","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"libEGL.dll","sha256":"7e0972f68e366e2e9d50fea0271c62a3feebb6c5eca7eb52d6be78474ce6969e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"libGLESv2.dll","sha256":"efec1c8df7a3110eb646201fd9dee99d661168b3f29b4be51ac732563b8b82fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"maintenanceservice.exe","sha256":"ecb58468c067e1e26be450cbefbddd75ff65bf75d01c7b709082def7416f4e28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"maintenanceservice_installer.exe","sha256":"859b53f9e83c4120e3baf6a2f9c07e0346efa7d81d9162a9f510de5eb78a9f93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"minidump-analyzer.exe","sha256":"ebdb6e258e0c79eaf80dd917fc67c4fada217be6af27aa40c0b7f6194dd2fdca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"mozavcodec.dll","sha256":"9c0b8d3c640b14beb8ae578f7f8490ab9c4bca4b5a2b8e2ee1581ad631eda5fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"mozavutil.dll","sha256":"2b23d80b89e6d1c846657eaa647605021047aa6af7b2f7a4b5366fd31d58289a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"mozglue.dll","sha256":"2f50778f91e13d45232a6836a263aad8ef12bbaa08f1536f1e6a0b0b4d05cb3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"msvcp140.dll","sha256":"c917e33f262b7733ed0ecaff40903d1dc464d2804d2cf29b14f356bb7d5361f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"nss3.dll","sha256":"81a3db5087e19eaa4353a2956eda377c636b3376a651511877bea6f0d2bb5fdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"nssckbi.dll","sha256":"80bc519547dea504c814110b6f789bb2e2b7b54a3595b2c793a3a7bfba2ad5c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"nssdbm3.dll","sha256":"cfeea2f88faefac030e66abbff18f657802b92b67dd3951e720abf0ff85a6a7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"pingsender.exe","sha256":"48698b12046f77175c809405ea4861b7d512dbb110d13e3b74083b0117b66fc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"plugin-container.exe","sha256":"0274d8b0cbdbf1bca6e79fddba87b8f8ec7979e028ee340dd092e84c003be9e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"plugin-hang-ui.exe","sha256":"cdb0630ed4d7d338aaeb50fd01fdb41ec8d5c6df7679483d5008d6b014c9a7af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"qipcap.dll","sha256":"b91392e3383a9c1ce60f9cebbfffea2cda54d3ac8947d7ebbff854309c14077c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"softokn3.dll","sha256":"d420cf1a2e35aa85a0fe44c7a371eab245d90d3b39a0d2c166ea6f1289da8bba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"ucrtbase.dll","sha256":"899fd1a470bdfab3aa271c11d4417bc67949af2edc1668abf3c488bca85cb0a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"updater.exe","sha256":"969334b564c5f30cdb44ddebfd0aaeb08e95542e0abc626f02ad0db52a65dc3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"vcruntime140.dll","sha256":"9bd36c33ae17e13f9d6f6d680e4657f69c8eb5b7b7ecb3a6297e9c79944eb5ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"rpcapd.exe","sha256":"1b010010f13116652aba12246fc73ffd3d17d71f9dba6950f7f80dadfc7e8871","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Qt5Core.dll","sha256":"a13915dc1830c3ed67f8b0550527c1bfb853ae526d9f5efa6668cf95ceca8885","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Qt5Gui.dll","sha256":"1db3d434f920c8a5a0145a4806036861a60eb02410ca04ed14d67d44bae95cf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Qt5Multimedia.dll","sha256":"81a71f7bcf8d2eba06fa4a8d05013ff507f2e364ab356d1867968148d76ad1b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Qt5Network.dll","sha256":"a17b85c8bd958a193de34f62d0a12dffa0116ee0b460863799ed0fddcc1f98db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Qt5PrintSupport.dll","sha256":"9cc9ef9cbb45d38cf70ad0bbfa1a153efd5b38a3152114b8fd893ef65f3f8cc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Qt5Svg.dll","sha256":"b556fafbc29a6cc38566d95f68e3ce42a4c29c3000fe5d7616e87918d27e4a4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Qt5Widgets.dll","sha256":"d84346567aded38176cabc755b66dfdc183aa2a11f88041b89b726ab2675a587","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Qt5WinExtras.dll","sha256":"379fbcc4a4c914b42ab18873a2cbb8661a7f4feb6b7239e357b2c47df3e27b88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"WinPcap_4_1_3.exe","sha256":"eae870bfca06e04f4839605e3f186c2d4f63e6d10b503c97ae1e70b93dc6ee99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"WinSparkle.dll","sha256":"949076c9a2131e529fe5106e10d3fc581792804088fe6c7658a8a5331770e271","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"capinfos.exe","sha256":"32eea1b6cc1d086eafd89bf3b4f07ee3f62e7e20ff7962ec531365929963e671","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"editcap.exe","sha256":"06ec7c618881b55f6af867f68676ca41dc0734dc76014812db877379d295367f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"libGLESV2.dll","sha256":"0f667339f40516d0cf4018640ea6d569e5d1d397d21c5b3ff82d559e95d29cba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"libgio-2.0-0.dll","sha256":"240a2078984b603e316daebf85bd8b95435b4bdd2ac0b80e9a9ab97a3bbb01f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"libgobject-2.0-0.dll","sha256":"cbfb39e2ac8442eb4b78bbae71da443fb35b7d5681863f691c78ae2865d999ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"libsbc-1.dll","sha256":"0dad9cf04bcb0935a308832b6338814d52205d1f1c713900754393170bd70c39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"libspandsp-2.dll","sha256":"662a00ff5a481ac7407becdda86750512ac5c46425142c42313a2bf81cc4b89d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"libssh.dll","sha256":"41ba6d1b415bc125f54359a47da5964fb34e7f4823e57cda4ff84b15e5f34fba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"libwscodecs.dll","sha256":"bec74ac6f22b804214fffb78a771dbbcce34eb620d3a8af1b88ffbba6137933e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"mergecap.exe","sha256":"3a3ebfd3cf0402dafc3eea9caaa1af243d7933048b6423f74a21a99a2e834e2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"rawshark.exe","sha256":"ee2f6cec37c97d3088da0c08a820190d37ae154f966b2928d1fdef96c8fd4c9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"reordercap.exe","sha256":"6110f71e20f38cddd888a27ae2ad07bda42de5d6eb7cf9568ba92fb30ded4277","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"text2pcap.exe","sha256":"e62b65a1e5141e171036fde1eca4dacf232e8fac8ecccba1511054d1589b2d21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"uninstall.exe","sha256":"3460669b39919ab3d26fa7b9e4468160736e2fd94963dee13e32a37ff4ed03b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"0YdED8h4YnKljVf.doc","sha256":"95b5b74f627d119a5839abadb41c06ee8d724ac69c1577e5e187c5ea4927e8ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"1LoWM7zNlVq8h.exe","sha256":"6f53e9e5f52ef5af7d685b780f12d6bac1163ba363db90892f54cf9dc1688868","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"3TXw.exe","sha256":"7a6240df6c2e65d3929e4024ea6258d470f9d7dddac6545c15d68d17b1425eb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"3VBXaPVG.exe","sha256":"784b72f43b72a851cbf75dc4777fed2f5e03607a78de37cf367a3622160720db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"3kNG.exe","sha256":"24bca61a4f5636dfb860db3857edbaca1a5f84175716f5abeb618d9fd9bdd0fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"6JQvD1.exe","sha256":"63e5ee98c5d034b1399973173a78290ff5f26d730b4c738c6494018cd78019b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"7GXTVgCwg.exe","sha256":"301dc455a0412f1c6dfdc66bcc8aa36c0d81f5bf69484e912ad32cf3cb8dcd55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"A6a4k093.exe","sha256":"988577dafa94f25fa448c4f8e4eb75402201605049b526dd9dbfa41e39cdfdb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"AMrt2OL.exe","sha256":"b9c88666676bd6b44173a2193fb229eae8f681f4d9426a75c871fb1085cc4188","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Byf3DiB7aX.doc","sha256":"42643b029a6efad19ae8015a8ef44b3cafe6b34f6bebf4405650f8e498598dd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"CJ8ZksCqfYdg3Ha.exe","sha256":"a5d7bf42a2e1d9264c70269741135e28390a04d3a48ef2fb7adce8692665e8f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"ara0UGGW3VRU.exe","sha256":"caf5455974f211e98e100cd5dd73cb8d76d4cbf6ccb1fd095aa80b1f396767c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Desktop.lnk","sha256":"045bf3626936d50faad4c182bf8bdaaf2fe421b98c3f94d8ef22425dde5275ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"Downloads.lnk","sha256":"ed3998be815c8ec190440896905e5920c32baad53c10a91cf7b73690ac169dd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"OneDrive.lnk","sha256":"7865801ab2a33064e7be8ab9029f959ed4a84f0689b9c5e1ce17c0213bb1d9e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"RecentPlaces.lnk","sha256":"b55beb036d782adbd877c7dd210c61ece923a0d645dae8bb1cccaf5ebe85b9bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"autoexec.bat","sha256":"04b45af830c0359d53f20e2ecef6d770e31f410f52b6926a347498862549ec4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]}],"files_written":[{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\zlib1.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%USERPROFILE%\\Downloads\\CQR0Rz.gif","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%WINDIR%\\System32\\en-US\\sc.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"C:\\Czuw.pIs","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%USERPROFILE%\\Desktop\\HowToDecrypt.txt","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"C:\\HowToDecrypt.txt","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"C:\\share\\HowToDecrypt.txt","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"C:\\share\\73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"C:\\73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\comerr32.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\dumpcap.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\k5sprt32.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\krb5_32.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libcares-2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libffi-6.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgcc_s_sjlj-1.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgcrypt-20.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libGeoIP-1.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libglib-2.0-0.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgmodule-2.0-0.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgmp-10.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgnutls-30.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgpg-error-0.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libhogweed-4-2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libintl-8.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\liblz4.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libnettle-6-2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libnghttp2-14.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libp11-kit-0.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libsmi-2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libsnappy-1.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libtasn1-6.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwinpthread-1.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwireshark.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwiretap.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwsutil.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libxml2-2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\lua52.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Wireshark\\tshark.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\sbdrop.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\sidebar.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\wlsrvc.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Portable Devices\\sqmapi.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\ImagingDevices.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\ImagingEngine.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoAcq.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoBase.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoViewer.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\mpvis.DLL","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\setup_wm.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmlaunch.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpconfig.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPDMC.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPDMCCore.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpenc.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmplayer.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPMediaSharing.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpnetwk.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpnscfg.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpnssci.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPNSSUI.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmprph.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpshare.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPSideShowGadget.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmssetup.ceb","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmssetup.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\msoe.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\MSOERES.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\oeimport.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wab.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wabfind.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wabimp.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wabmig.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpAsDesc.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpClient.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpCmdRun.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpCommu.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpEvMsg.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpOAV.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpRTP.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpSvc.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MSASCui.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MsMpCom.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MsMpLics.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MsMpRes.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\D3DCompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsHub.DataWarehouse.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsHub.ScriptedSandboxPlugin.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsHub_is.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsTap.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ExtExport.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\F12.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\F12Resources.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\F12Tools.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ie9props.propdesc","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iediagcmd.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iedvtool.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ieinstal.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ielowutil.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\IEShims.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iessetup.ceb","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iessetup.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\jsdbgui.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\jsdebuggeride.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\JSProfilerCore.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\jsprofilerui.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\MemoryAnalyzer.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\msdbg2.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\networkinspection.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\pdm.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\pdmproxy100.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\perfcore.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\perf_nt.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\sqmapi.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\Timeline.cpu.xml","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\Timeline.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\Timeline_is.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\audiodepthconverter.ax","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\bod_r.TTF","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\directshowtap.ax","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\DVDMaker.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\Eurosti.TTF","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\fieldswitch.ax","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\offset.ax","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\OmdBase.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\OmdProject.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\Pipeline.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\PipeTran.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\rtstreamsink.ax","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\rtstreamsource.ax","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\SecretST.TTF","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\soniccolorconverter.ax","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\sonicsptransform.ax","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\WMM2CLIP.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7-zip.dll","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\BITBUCKET\\VOLUME\\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\\","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\AEEAEE SET","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]},{"name":"AEEAEE SET","sources":[{"report_type":"sandbox","report_id":"5f213e37855ab447c221f8ff"}]}]}},"report_ids":{"sandbox_job_ids":["5f213e37855ab447c221f8ff"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.A095D3DB Sample 73a10be31832… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 73a10be31832…. Malware family: Ransom.A095D3DB. Threat score 75/100. 18/28 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.A095D3DB Sample 73a10be31832… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 73a10be31832…. Malware family: Ransom.A095D3DB. Threat score 75/100. 18/28 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.A095D3DB Sample 73a10be31832… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 73a10be31832…. Malware family: Ransom.A095D3DB. Threat score 75/100. 18/28 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]