26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T47d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Locky.Generic Sample 141470b7e443… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 141470b7e443…. Malware family: Locky.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/141470b7e44308fc541be2476092cfd8f2b6140bc698bd51c088b89331cfd4b5","keywords":["Malicious","Locky.Generic","malware analysis","sandbox report","threat intelligence","141470b7e44308fc541be2476092cfd8f2b6140bc698bd51c088b89331cfd4b5"],"about":{"@type":"SoftwareApplication","name":"14.exe","applicationCategory":["peexe","executable"],"identifier":"141470b7e44308fc541be2476092cfd8f2b6140bc698bd51c088b89331cfd4b5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Locky.Generic","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T414,"" loaded module "KERNEL32.DLL" at base 76FC0000 "" loaded module "USER32.DLL" at base 76C20000 "" loaded module "GDI32.DLL" at base 77340000 "" loaded module "ADVAPI32.DLL" at base 76D50000 "" loaded module "SHELL32.DLL" at base 75870000 "" loaded module "WININET.DLL" at base 76EC0000 "" loaded module "MPR.DLL" at base 721B0000 "" loaded module "NETAPI32.DLL" at base 73CA0000 "" loaded module "CRYPTSP.DLL" at base 74FF0000 "" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74D90000 "" loaded module "CRYPTBASE.DLL" at base 754C0000 "" loaded module "COMCTL32.DLL" at base 74440000 "" loaded module "OLE32.DLL" at base 764C0000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77590000 "" loaded module "PROFAPI.DLL" at base 75570000 "" loaded module "NTMARTA.DLL" at base 74B0000028:T62a,"32C0D883E1644D0AFDCE026D8652400D.locky.218156" has type "data" "_Locky_recover_instructions.txt.218421" has type "UTF-8 Unicode (with BOM) text, with CRLF line terminators" "32C0D883E1644D0A148166AF72FC1A0A.locky.218500" has type "XML document text" "32C0D883E1644D0ABDFABD798B5B9A4A.locky.218640" has type "XML document text" "32C0D883E1644D0AE70F36E912BA8D42.locky.218750" has type "XML document text" "32C0D883E1644D0AA40EF7F68B252C8D.locky.218875" has type "XML document text" "32C0D883E1644D0AF43BED6C06E24D82.locky.218984" has type "XML document text" "32C0D883E1644D0A7E700DE07B959655.locky.219109" has type "XML document text" "32C0D883E1644D0A7BF8A168E9A471F4.locky.219218" has type "XML document text" "32C0D883E1644D0A15F8ED4775AF308F.locky.219406" has type "XML document text" "32C0D883E1644D0A0F1EF242D37719D1.locky.219546" has type "XML document text" "32C0D883E1644D0A5F44D7C62684B9BA.locky.219687" has type "XML document text" "32C0D883E1644D0A91A756CB2E9DF532.locky.219890" has type "XML document text" "32C0D883E1644D0A63BF8CCFCCFC96AE.locky.220015" has type "XML document text" "32C0D883E1644D0AFD2D003156EBEE8C.locky.220171" has type "XML document text" "32C0D883E1644D0A369FCC65CD857BD9.locky.220328" has type "XML document text" "32C0D883E1644D0A06A53F09742B4709.locky.220453" has type "XML document text" "32C0D883E1644D0A4929039BFD6A990E.locky.220593" has type "XML document text" "32C0D883E1644D0ADE3837296C62CB2C.locky.220718" has type "XML document text" "32C0D883E1644D0AAD648E2A29BDE75F.locky.220812" has type "XML document text"29:T894,"" opened "UNC\192.168.56.1\VM14\VxStream\libs\commons-io-2.4.jar" with delete access "" opened "UNC\192.168.56.1\VM14\VxStream\libs\spring-core-4.0.5.RELEASE.jar" with delete access "" opened "UNC\192.168.56.1\VM14\VxStream\libs\spring-beans-4.0.5.RELEASE.jar" with delete access "" opened "UNC\192.168.56.1\VM14\VxStream\libs\commons-logging-1.1.3.jar" with delete access "" opened "UNC\192.168.56.1\VM14\VxStream\libs\jcommander-1.35.jar" with delete access "" opened "UNC\192.168.56.1\VM14\VxStream\libs\log4j-1.2.17.jar" with delete access "" opened "UNC\192.168.56.1\VM14\VxStream\libs\spring-context-4.0.5.RELEASE.jar" with delete access "" opened "UNC\192.168.56.1\VM14\VxStream\libs\VxUtils.jar" with delete access "" opened "UNC\192.168.56.1\VM14\VxStream\libs\spring-expression-4.0.5.RELEASE.jar" with delete access "" opened "UNC\192.168.56.1\VM14\VxStream\libs\spring-context-support-4.0.5.RELEASE.jar" with delete access "" opened "UNC\192.168.56.1\VM14\icon.png" with delete access "" opened "c:\autoexec.bat" with delete access "" opened "c:\MSOCache\All Users\{90120000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0015-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0016-0407-0000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0016-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0018-0407-0000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0018-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0019-0407-0000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0019-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access2a:T986,Found dropped filename "32C0D883E1644D0AFDCE026D8652400D.locky.218156" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A148166AF72FC1A0A.locky.218500" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0ABDFABD798B5B9A4A.locky.218640" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AE70F36E912BA8D42.locky.218750" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AA40EF7F68B252C8D.locky.218875" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AF43BED6C06E24D82.locky.218984" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A7E700DE07B959655.locky.219109" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A7BF8A168E9A471F4.locky.219218" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A15F8ED4775AF308F.locky.219406" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A0F1EF242D37719D1.locky.219546" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A5F44D7C62684B9BA.locky.219687" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A91A756CB2E9DF532.locky.219890" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A63BF8CCFCCFC96AE.locky.220015" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AFD2D003156EBEE8C.locky.220171" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A369FCC65CD857BD9.locky.220328" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A06A53F09742B4709.locky.220453" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A4929039BFD6A990E.locky.220593" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0ADE3837296C62CB2C.locky.220718" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AAD648E2A29BDE75F.locky.220812" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A1A9E3B8AB6F61A36.locky.220953" which has been seen in the context of ransomware1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"141470b7e44308fc541be2476092cfd8f2b6140bc698bd51c088b89331cfd4b5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790432238809,"unified_at":"2026-09-26T14:17:18.809Z","metadata":{"hashes":{"sha256":"141470b7e44308fc541be2476092cfd8f2b6140bc698bd51c088b89331cfd4b5","sha1":"d99e90f8fdc5a47bbc7efa9caf8aefdc718cfcbe","md5":"4d9838607597427f2dd6b1d2092f1e76","sha512":"432b8af6506a01cbd09d3174796e9ced08cd26d2454627cad2301f6193a4e99d8ff6076880f2cf731c07387b3aaeeb910fcbc828776818f5227708c72ff8bc86","ssdeep":"6144:yrJMzXjSjTFqGl7mYtcWVNhMqsjbyqSQ:yVMDjuTHdmK5uDH","ssdeep_chunks":["6144:yrJMzXj","6144:rJMzXjS","6144:JMzXjSj","6144:MzXjSjT","6144:zXjSjTF","6144:XjSjTFq","6144:jSjTFqG","6144:SjTFqGl","6144:jTFqGl7","6144:TFqGl7m","6144:FqGl7mY","6144:qGl7mYt","6144:Gl7mYtc","6144:l7mYtcW","6144:7mYtcWV","6144:mYtcWVN","6144:YtcWVNh","6144:tcWVNhM","6144:cWVNhMq","6144:WVNhMqs","6144:VNhMqsj","6144:NhMqsjb","6144:hMqsjby","6144:Mqsjbyq","6144:qsjbyqS","6144:sjbyqSQ","12288:yrJMzXj","12288:rJMzXjS","12288:JMzXjSj","12288:MzXjSjT","12288:zXjSjTF","12288:XjSjTFq","12288:jSjTFqG","12288:SjTFqGl","12288:jTFqGl7","12288:TFqGl7m","12288:FqGl7mY","12288:qGl7mYt","12288:Gl7mYtc","12288:l7mYtcW","12288:7mYtcWV","12288:mYtcWVN","12288:YtcWVNh","12288:tcWVNhM","12288:cWVNhMq","12288:WVNhMqs","12288:VNhMqsj","12288:NhMqsjb","12288:hMqsjby","12288:Mqsjbyq","12288:qsjbyqS","12288:sjbyqSQ","6144:yVMDjuT","6144:VMDjuTH","6144:MDjuTHd","6144:DjuTHdm","6144:juTHdmK","6144:uTHdmK5","6144:THdmK5u","6144:HdmK5uD","6144:dmK5uDH"],"imphash":"ef897b5762a56845da7ef71ea2890e9b"},"file_info":{"file_name":"14.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":238592,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295585000,"last_seen":1653478142000,"last_multi_scan":1653478142000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":15,"malicious_count":8,"total":33},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Lockycrypt.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Locky.gena","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Locky.fdi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Locky.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Yakes.EQX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Locky.G.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Locky.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.ERXQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004e0cea1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt.egb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-FHB!4D9838607597","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dwn.ebdimy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Locky.ME5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-CZH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Locky","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.6CFC37B1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.6CFC37B1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanPSW.Spy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Locky.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00169687-00002356-7748228D-175751\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00169687-00002356-7748228D-175876","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00169687-00002356-7748228D-175718","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"217.12.199.150:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\4x94brb\\6\\7\\sqt\\rzx\\nztobou\\t1fl7fg\\0\\n44\\7r\\4gpyeen\\d6898.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$27","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RtlCompressBuffer@ntdll.dll\"\n \"RtlDecompressBuffer@ntdll.dll\"\n \"CryptCreateHash@ADVAPI32.dll\"\n \"AccessCheck@ADVAPI32.dll\"\n \"MapGenericMask@ADVAPI32.dll\"\n \"DuplicateToken@ADVAPI32.dll\"\n \"OpenThreadToken@ADVAPI32.dll\"\n \"GetFileSecurityW@ADVAPI32.dll\"\n \"CryptHashData@ADVAPI32.dll\"\n \"SetTokenInformation@ADVAPI32.dll\"\n \"OpenProcessToken@ADVAPI32.dll\"\n \"CryptDestroyHash@ADVAPI32.dll\"\n \"CryptGetHashParam@ADVAPI32.dll\"\n \"RegSetValueExW@ADVAPI32.dll\"\n \"RegQueryValueExA@ADVAPI32.dll\"\n \"RegDeleteValueA@ADVAPI32.dll\"\n \"RegSetValueExA@ADVAPI32.dll\"\n \"RegCreateKeyExA@ADVAPI32.dll\"\n \"RegCloseKey@ADVAPI32.dll\"\n \"RegOpenKeyExA@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00169687-00002356-7748228D-208859","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Douthsoftware.com\"\n Heuristic match: \"ware.com\"\n Pattern match: \"http://en.wikipedia.org/wiki/RSA_(cryptosystem)\"\n Pattern match: \"http://en.wikipedia.org/wiki/Advanced_Encryption_Standard\"\n Pattern match: \"http://i3ezlvkoi7fwyood.tor2web.org/32C0D883E1644D0A\"\n Pattern match: \"http://i3ezlvkoi7fwyood.onion.to/32C0D883E1644D0A\"\n Pattern match: \"http://i3ezlvkoi7fwyood.onion.cab/32C0D883E1644D0A\"\n Pattern match: \"https://www.torproject.org/download/download-easy.html\"\n Heuristic match: \"QW _Y~yS)'o!hH&E3TPVf\\?smQDC^T}m_E\\m|N4Eb+(5pQ|P{_v3>$*n S?P&W9SQA1:W&zdH[&lSt]+3n}%_{g*5Vp{]].KN\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00169687-00002356-7748228D-175843","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00169687-00002356-7748228D-175846\n RasRpcGetVersion@RASMAN.DLL at 00169687-00002356-7748228D-205675\n GetVersion@KERNEL32.DLL at 00169687-00002356-6917-3-00862726","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00169687-00002356-6917-3-00862726","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /main.php HTTP/1.1\nHost: 217.12.199.150\nContent-Length: 100\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload\n \"POST /main.php HTTP/1.1\nHost: 217.12.199.150\nContent-Length: 55\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload\n \"POST /main.php HTTP/1.1\nHost: 217.12.199.150\nContent-Length: 113\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload\n \"POST /main.php HTTP/1.1\nHost: 217.12.199.150\nContent-Length: 93\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\\"\n \"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Windows\\system32\\vssadmin.exe\"\n \"\" created file \"C:\\Windows\\Fonts\\staticcache.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@??? at 00169687-00002356-7748228D-201484\n RasPortListen@RASMAN.DLL at 00169687-00002356-7748228D-205332","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"217.12.199.150\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Changes the desktop background picture","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\CONTROL PANEL\\DESKTOP\", Key: \"WALLPAPERSTYLE\", Value: \"30000000\")\n \"\" (Access type: \"SETVAL\", Path: \"HKCU\\CONTROL PANEL\\DESKTOP\", Key: \"TILEWALLPAPER\", Value: \"30000000\")","origin":"Registry Access","relevance":10,"id":"registry-22","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\" !!! IMPORTANT INFORMATION !!!!\n\nAll of your files are encrypted with RSA-2048 and AES-128 ciphers.\nMore information about the RSA and AES can be found here:\n http://en.wikipedia.org/wiki/RSA_(cryptosystem)\n http://en.wikipedia.org/w\" (Source: 00169687-00002356-77466A68-211062, Indicator: \"files are encrypted\")\n \"All of your files are encrypted with RSA-2048 and AES-128 ciphers.\" (Source: _Locky_recover_instructions.txt, Indicator: \"files are encrypted\")\n \"Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server.\" (Source: _Locky_recover_instructions.txt, Indicator: \"private key and decrypt program\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateDirectoryW\n CreateFileW\n FindNextFileW\n GetModuleFileNameW\n GetCommandLineA\n GetTempPathW\n WriteFile\n OutputDebugStringW\n VirtualProtectEx\n LoadLibraryExA\n GetFileSize\n GetFileAttributesW\n LockResource\n VirtualAlloc\n FindFirstFileW\n CopyFileW\n GetDriveTypeW\n VirtualProtect\n TerminateProcess\n DeleteFileW\n GetStartupInfoW\n GetModuleHandleW\n GetVersionExW\n GetVersionExA\n CreateProcessW\n UnhandledExceptionFilter\n GetTickCount\n GetFileAttributesA\n GetStartupInfoA\n LoadLibraryA\n GetModuleFileNameA\n GetProcAddress\n GetModuleHandleA\n LoadLibraryW\n RegDeleteValueA\n RegOpenKeyExA\n RegOpenKeyA\n RegOpenKeyW\n RegEnumKeyExW\n RegCreateKeyExA\n RegOpenKeyExW\n RegCreateKeyExW\n RegCloseKey\n RegEnumKeyW\n RegDeleteValueW\n CryptEncrypt\n RegDeleteKeyW\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"22/57 Antivirus vendors marked sample as malicious (38% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"22/57 Antivirus vendors marked sample as malicious (38% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"vssadmin.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"vssadmin.exe\" (PID: 00002608)\n \"\" wrote 52 bytes to a foreign process \"vssadmin.exe\" (PID: 00002608)\n \"\" wrote 4 bytes to a foreign process \"vssadmin.exe\" (PID: 00002608)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00210718-00002608)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The input sample dropped a known ransomware file","description":"$2a","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")\n \"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00169687-00002356-7748228D-383734","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"The input sample dropped a known ransomware file"},{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":63,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":144,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"56ed1b1caac2edc9157b23c7","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Coantor","contacted_countries":["UKR"],"submit_name":"14.exe","analysis_start_time":"2016-03-19T04:26:26+00:00","indicators_count":{"informative":10,"suspicious":22,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"217.12.199.150","port":80,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]}],"dns_resolutions":null,"http_requests":[{"host":"217.12.199.150","host_ip":"217.12.199.150:80","url":"/main.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}],"processes":[{"pid":2356,"ppid":0,"name":"14.exe","command_line":"","normalized_path":"","uid":"00169687-00002356"},{"pid":2608,"ppid":0,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","normalized_path":"","uid":"00210718-00002608"}],"all_imported_dlls":["rasman.dll","rasadhlp.dll","wshtcpip.DLL","VssTrace.DLL","SHLWAPI.dll","USER32.dll","COMCTL32.dll","VERSION.dll","ntmarta.dll","CLBCatQ.DLL","oledlg.dll","RASAPI32.dll","kernel32.dll","CRYPTSP.dll","netutils.dll","PROPSYS.dll","CFGMGR32.dll","msvcrt.dll","sensapi.dll","VSSAPI.DLL","USP10.dll","ole32.dll","mswsock.dll","gdiplus.dll","PSAPI.DLL","WININET.dll","ATL.DLL","RpcRtRemote.dll","COMDLG32.dll","SspiCli.dll","SHELL32.dll","MPR.dll","KERNELBASE.dll","NETAPI32.dll","DEVOBJ.dll","OLEAUT32.dll","davclnt.dll","wkscli.dll","LPK.dll","IMM32.DLL","rtutils.dll","apphelp.dll","ADVAPI32.dll","iphlpapi.DLL","cscapi.dll","WindowsCodecs.dll","uxtheme.dll","profapi.dll","drprov.dll","GDI32.dll","sechost.dll","wshqos.dll","vss_ps.dll","ntdll.dll","SETUPAPI.dll","NLAapi.dll","browcli.dll","RPCRT4.dll","MSCTF.dll","rsaenh.dll","ntlanman.dll","IconCodecService.dll","CRYPTBASE.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"UNC\\192.168.56.1\\VM14\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\32C0D883E1644D0AFDCE026D8652400D.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0015-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A148166AF72FC1A0A.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0015-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0015-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0ABDFABD798B5B9A4A.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0016-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AE70F36E912BA8D42.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0016-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0016-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AA40EF7F68B252C8D.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0018-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AF43BED6C06E24D82.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0018-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0018-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A7E700DE07B959655.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0019-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A7BF8A168E9A471F4.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0019-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0019-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A15F8ED4775AF308F.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001A-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A0F1EF242D37719D1.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-001A-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001A-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A5F44D7C62684B9BA.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001B-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A91A756CB2E9DF532.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-001B-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001B-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A63BF8CCFCCFC96AE.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.de\\32C0D883E1644D0AFD2D003156EBEE8C.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.de\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.en\\32C0D883E1644D0A369FCC65CD857BD9.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.en\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.fr\\32C0D883E1644D0A06A53F09742B4709.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.fr\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.it\\32C0D883E1644D0A4929039BFD6A990E.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.it\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0ADE3837296C62CB2C.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AAD648E2A29BDE75F.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A1A9E3B8AB6F61A36.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0ACDE6275DAB309E0E.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A60BE49B2B18D09FC.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\32C0D883E1644D0A54D9FFAF1C91B624.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\32C0D883E1644D0AF297450C77352971.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"C:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\32C0D883E1644D0AF8D761E366A542EF.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\32C0D883E1644D0A3B7967BD463F669A.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0A02204FA772601FBE.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\32C0D883E1644D0A2AFDDE0B96BBF6DE.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\32C0D883E1644D0AA3B2F7F9B37AC1C3.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\32C0D883E1644D0A0F15C9651C5A808D.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\32C0D883E1644D0A4630D34610E337A3.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\32C0D883E1644D0A7B33C3A0743F7AE3.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Sun\\Java\\Java Update\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSScan\\32C0D883E1644D0A30E9594A5AB6B328.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSScan\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\32C0D883E1644D0A5A3F0EBDE198E837.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0AA1AFBE5BF9FFC73C.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A6231A2E1C8BB13CE.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A39A74138F36ACA62.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0ABA7CA8634508D595.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0AFE6C6828754A931B.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0AA8E3658F5465C850.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0ABBBA8EB7FD87EDCC.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A9B29606DE7439A57.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A0A01D706228B274E.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A58F05F990125C188.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A7162E5F553FE5BF8.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AFD99B20F396244B7.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AC7400D865C42759E.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A1D3DBD1FEC9A8112.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0ADDAE624F73DC6E50.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A39011FFF216FE335.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A82F81EA4DE59CFDB.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0ACA6E60E0E788ED72.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A1C08BE9FB7737ED1.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A88A88E51F7159655.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AC2601401FFEE7942.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A3C5973A97928AEB1.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A6405F60D3F7C9AB6.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A8BEA2053206A1041.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A406DE18B94016E47.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AD1E8E52399C079B5.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A7AB9BA8AE1E5E00D.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AD67D4FC8CBF33225.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A38BB38D43FBAC1C7.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A65BE65B64CA259D1.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A1045FFA20F1F24DA.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A6E42CD58EEC4208A.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A9CCCA5E4DDCF9AEE.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A30F8E41CFBB7E4D5.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0ADF8A80DA5978A601.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A5EEB553B5C5AC26A.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A037DC007A90A57A0.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A11D920C97805B198.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AA3F9C6E8B92191D0.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\32C0D883E1644D0AC5FB2C4EC637E3A2.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\32C0D883E1644D0AB7815026B27AB52F.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0A0CB1D0F089650724.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0A8C16CBFC569F7B88.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0AE84FA99CF88D91EE.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0ADAF1D781679C149C.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\32C0D883E1644D0AC4A3B64A609E24FD.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\32C0D883E1644D0A02694D1F3C61FE59.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AE1274103098E1AFB.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AD2628AFF52B513DA.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AEBCF7AB905F10AC2.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AF2B1F0B6297940A2.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\DATA\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\32C0D883E1644D0AAD8C2559C59446E7.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\32C0D883E1644D0A3B90F0B8805055DA.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\32C0D883E1644D0A0973AE31DFC37BA4.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"c:\\share.zip","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\32C0D883E1644D0A032BAC8A31327EBF.locky","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%USERPROFILE%\\Desktop\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"path":"%USERPROFILE%\\Desktop\\_Locky_recover_instructions.bmp","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\14_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\14_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"key":"HKCU\\SOFTWARE\\LOCKY\\","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56ed1b1caac2edc9157b23c7"}]}]}},"report_ids":{"sandbox_job_ids":["56ed1b1caac2edc9157b23c7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Locky.Generic Sample 141470b7e443… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 141470b7e443…. Malware family: Locky.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/141470b7e44308fc541be2476092cfd8f2b6140bc698bd51c088b89331cfd4b5"}],["$","meta","4",{"property":"og:title","content":"Malicious Locky.Generic Sample 141470b7e443… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 141470b7e443…. Malware family: Locky.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/141470b7e44308fc541be2476092cfd8f2b6140bc698bd51c088b89331cfd4b5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Locky.Generic Sample 141470b7e443… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 141470b7e443…. Malware family: Locky.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]