dftw

26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom Sample 15e8c986c460… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 15e8c986c460…. Malware family: Trojan.Ransom. Threat score 100/100. 21/25 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","keywords":["Malicious","Trojan.Ransom","malware analysis","sandbox report","threat intelligence","15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704"],"about":{"@type":"SoftwareApplication","name":"tOldHSYWDVTCGAtymDVTCGAtym","applicationCategory":["peexe","executable"],"identifier":"15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom","antivirusDetections":{"malicious":21,"total":25},"behavioralIndicators":{"malicious":6,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2779,Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHandleCount"; Source: "sample.bin"), Found reference to API (Indicator: "AddAtomA"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "AddAtomW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadTimes"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessWorkingSetSize"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpQueryOption"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeNameW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWorkingSetSize"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetAtomNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserNameA"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "OpenEventLogW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessShutdownParameters"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimes"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowScrollBar"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetScrollRange"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommProperties"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin")28:T81e,"" queries volume information of unknown location at 00010948-00002500-00000046-99867617 "" queries volume information of unknown location at 00010948-00002500-00000046-99867684 "" queries volume information of unknown location at 00010948-00002500-00000046-99867852 "" queries volume information of unknown location at 00010948-00002500-00000046-99867934 "" queries volume information of unknown location at 00010948-00002500-00000046-99868000 "" queries volume information of unknown location at 00010948-00002500-00000046-99868041 "" queries volume information of unknown location at 00010948-00002500-00000046-99868120 "" queries volume information of unknown location at 00010948-00002500-00000046-99868205 "" queries volume information of unknown location at 00010948-00002500-00000046-99868270 "" queries volume information of unknown location at 00010948-00002500-00000046-99868336 "" queries volume information of unknown location at 00010948-00002500-00000046-99868409 "" queries volume information of unknown location at 00010948-00002500-00000046-99868479 "" queries volume information of unknown location at 00010948-00002500-00000046-99868550 "" queries volume information of unknown location at 00010948-00002500-00000046-99868622 "" queries volume information of unknown location at 00010948-00002500-00000046-99868696 "" queries volume information of unknown location at 00010948-00002500-00000046-99868762 "" queries volume information of unknown location at 00010948-00002500-00000046-99868827 "" queries volume information of unknown location at 00010948-00002500-00000046-99868893 "" queries volume information of unknown location at 00010948-00002500-00000046-99868963 "" queries volume information of unknown location at 00010948-00002500-00000046-9986903529:Tfe2,"" wrote 176 bytes to file "C:\USERS\DESKTOP.INI" (Byte Offset: 0): �9{��)�0JO鰚�;MѸ#i��K-n1�"��a��}�QU��rs��}w�We�0�Q��,t��m��tR�P��`��ʌ�X�v7/�Tm��=є��Qm��<��%s]��ws}�" wrote 32 bytes to file "C:\USERS\DESKTOP.INI" (Byte Offset: 176): �W�c�g��6��`4�!��.g�ulD��, "" wrote 16 bytes to file "C:\USERS\DESKTOP.INI" (Byte Offset: 208): ��, "" wrote 128 bytes to file "C:\USERS\DESKTOP.INI" (Byte Offset: 224): ��, "" wrote 768 bytes to file "C:\USERS\DESKTOP.INI" (Byte Offset: 352): 0C 1B 5D 1D DC 95 2E 6F A6 EE 29 0C EF E7 3C 5DEC E7 5C 4C 09 E7 5C 7F 4A 53 2B 3E 6D 0C C6 6E58 3D B6 3F 26 57 07 F9 04 3B 6A B9 6E B0 F5 7006 19 C2 DB 98 42 26 1C 39 7D A7 B5 B7 91 24 EC6E 76 DF B1 4E 02 24 86 AA CC BE 01 52 A4 CB 3869 A9 D5 FC F9 3 ..., "" wrote 176 bytes to file "C:\USERS\PUBLIC\DESKTOP.INI" (Byte Offset: 0): [#�, "" wrote 32 bytes to file "C:\USERS\PUBLIC\DESKTOP.INI" (Byte Offset: 176): ��?ib��O�֞��ޕ��uݾ�+ٰ?ԉ, "" wrote 16 bytes to file "C:\USERS\PUBLIC\DESKTOP.INI" (Byte Offset: 208): ��, "" wrote 128 bytes to file "C:\USERS\PUBLIC\DESKTOP.INI" (Byte Offset: 224): ��, "" wrote 768 bytes to file "C:\USERS\PUBLIC\DESKTOP.INI" (Byte Offset: 352): 0C 1B 5D 1D DC 95 2E 6F A6 EE 29 0C EF E7 3C 5DEC E7 5C 4C 09 E7 5C 7F 4A 53 2B 3E 6D 0C C6 6E58 3D B6 3F 26 57 07 F9 04 3B 6A B9 6E B0 F5 7006 19 C2 DB 98 42 26 1C 39 7D A7 B5 B7 91 24 EC6E 76 DF B1 4E 02 24 86 AA CC BE 01 52 A4 CB 3869 A9 D5 FC F9 3 ..., "" wrote 384 bytes to file "C:\USERS\PUBLIC\VIDEOS\DESKTOP.INI" (Byte Offset: 0): �o��, "" wrote 32 bytes to file "C:\USERS\PUBLIC\VIDEOS\DESKTOP.INI" (Byte Offset: 384): ��RWC��G0V��=�YnFZ�*c޲j�, "" wrote 16 bytes to file "C:\USERS\PUBLIC\VIDEOS\DESKTOP.INI" (Byte Offset: 416): �5�بJ��@�˕C, "" wrote 128 bytes to file "C:\USERS\PUBLIC\VIDEOS\DESKTOP.INI" (Byte Offset: 432): ��, "" wrote 768 bytes to file "C:\USERS\PUBLIC\VIDEOS\DESKTOP.INI" (Byte Offset: 560): 0C 1B 5D 1D DC 95 2E 6F A6 EE 29 0C EF E7 3C 5DEC E7 5C 4C 09 E7 5C 7F 4A 53 2B 3E 6D 0C C6 6E58 3D B6 3F 26 57 07 F9 04 3B 6A B9 6E B0 F5 7006 19 C2 DB 98 42 26 1C 39 7D A7 B5 B7 91 24 EC6E 76 DF B1 4E 02 24 86 AA CC BE 01 52 A4 CB 3869 A9 D5 FC F9 3 ..., "" wrote 336 bytes to file "C:\USERS\PUBLIC\VIDEOS\SAMPLE VIDEOS\DESKTOP.INI" (Byte Offset: 0): �0U��a��5��nV�ePg)+1��@zj��G'�M��P$?�+[��W�d�ܺ��p��W��v��1xX��n��{c��5ȶȬ��y�x�S5�l[�+��Γ^��&(ݏ�(��+*��Qf\��̭�T��p�j?��Ő�[��B>� �u\��0?�G��4�cw��3 ..., "" wrote 32 bytes to file "C:\USERS\PUBLIC\VIDEOS\SAMPLE VIDEOS\DESKTOP.INI" (Byte Offset: 336): k�2�ǒ1T3��bo��T�g�դF44�V, "" wrote 16 bytes to file "C:\USERS\PUBLIC\VIDEOS\SAMPLE VIDEOS\DESKTOP.INI" (Byte Offset: 368): Ғ�,�e�&5gO�j�, "" wrote 128 bytes to file "C:\USERS\PUBLIC\VIDEOS\SAMPLE VIDEOS\DESKTOP.INI" (Byte Offset: 384): ��, "" wrote 768 bytes to file "C:\USERS\PUBLIC\VIDEOS\SAMPLE VIDEOS\DESKTOP.INI" (Byte Offset: 512): 0C 1B 5D 1D DC 95 2E 6F A6 EE 29 0C EF E7 3C 5DEC E7 5C 4C 09 E7 5C 7F 4A 53 2B 3E 6D 0C C6 6E58 3D B6 3F 26 57 07 F9 04 3B 6A B9 6E B0 F5 7006 19 C2 DB 98 42 26 1C 39 7D A7 B5 B7 91 24 EC6E 76 DF B1 4E 02 24 86 AA CC BE 01 52 A4 CB 3869 A9 D5 FC F9 3 ...2a:T77d,"" opened "C:\Users\desktop.ini" with delete access "" opened "C:\Users\Public\desktop.ini" with delete access "" opened "C:\Users\Public\Videos\desktop.ini" with delete access "" opened "C:\Users\Public\Videos\Sample Videos\desktop.ini" with delete access "" opened "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv" with delete access "" opened "C:\Users\Public\Recorded TV\desktop.ini" with delete access "" opened "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" with delete access "" opened "C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "" opened "C:\Users\Public\Pictures\desktop.ini" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Desert.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\desktop.ini" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Koala.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg" with delete access "" opened "C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg" with delete access "" opened "C:\Users\Public\Music\desktop.ini" with delete access "" opened "C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg" with delete access2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAiIiAiICAAIgAAAAAAAAAAAAIgAAAAACIAAAAAAAAB3d3d3AAAIAIiAAAAAAAd3eIiIh3dwgIAAiAAAAAd3eIh3d3iHd3AACIAAAAB3eHd3d3d3d4d3AAAAAAAHeId3d4d3d3d4h3AAAAAAd4d3d3iHh3d3d3h3AAAAAHeHd3d3h3iHd3d4dwAAAAd4d3d3d4h4eHh3d4dwAAAHd3d3d3d4h4h3h3d3cAAAB4iHd3d3d3d3d4d3eHAAAHeIiHd3d3d3eHiHh3h3AAB4iIiIh3eAAHeIh4eIhwAAeIiIiIh4iAAHeIiId4cACHiIiIiHeIiIB3eIeIeHAIh4iIiIh3iIAAd4iIiIhwCIeIiIiIh4AAiHeIiIiIcAiHiIiIiId4gId3d4iIiHAAh3iIiIiId3d3d3d3eIdwAIB4iIiIiIh3h3d3d3eHAACAd4iIiIiIiIh3d3d3dwAAAHeIiIiIiIiId3d3d3cAAACHeIiIiIiIiId3d4d4CACAB3iIiIiIiIiHd3eHcIiAAAB3iIiIiIiIiHeIdwgAgAAAB3eIiIiIiIh3d3gIAAAAAAh3d4iIiIiId3cAAAAAAAAICHd3iIiId3cAAAAAAAAAAIAAB3d3d3gIAAAAAAAAAAAACAAAgACACAAAAAAAAAAAAAAIAAgIAAAAAAAAD//ggA//+P6P/AAgD/gAAc/gAAOfwAAD/4AAAP8AAAD+AAAAfgAAAH4AAAA+AAAAPAAAADwACAA8AAYAOAACADAAAAAwADgAMAAAADgAAAAwAAAAOgAAADoAAABKAAAACQAAAA+AAAFvgAABL8AAB/+AAA//7wBf//zsn///Nb/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790720445309,"unified_at":"2026-09-29T22:20:45.309Z","metadata":{"hashes":{"sha256":"15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","sha1":"870823725625a440013533a4763f1a21d85005f2","md5":"3c701aa97f42c4861ea2c371d6f7e32f","sha512":"d4089284784cd8d8821a6d8e08b781131dac38a046e3ae0db3fc3fa4e6c69b8b53fb9f06ca3551d27b452de3190eafc48a5cd74c4250bb5f03f648904a4af82f","ssdeep":"3072:v8TI8SbHinW9gg+4o3AKljKltCTVpsNzMtwaN9pycD8Y:v8THSbHeWNaluvyVRyI9WY","ssdeep_chunks":["3072:v8TI8Sb","3072:8TI8SbH","3072:TI8SbHi","3072:I8SbHin","3072:8SbHinW","3072:SbHinW9","3072:bHinW9g","3072:HinW9gg","3072:inW9gg+","3072:nW9gg+4","3072:W9gg+4o","3072:9gg+4o3","3072:gg+4o3A","3072:g+4o3AK","3072:+4o3AKl","3072:4o3AKlj","3072:o3AKljK","3072:3AKljKl","3072:AKljKlt","3072:KljKltC","3072:ljKltCT","3072:jKltCTV","3072:KltCTVp","3072:ltCTVps","3072:tCTVpsN","3072:CTVpsNz","3072:TVpsNzM","3072:VpsNzMt","3072:psNzMtw","3072:sNzMtwa","3072:NzMtwaN","3072:zMtwaN9","3072:MtwaN9p","3072:twaN9py","3072:waN9pyc","3072:aN9pycD","3072:N9pycD8","3072:9pycD8Y","6144:v8TI8Sb","6144:8TI8SbH","6144:TI8SbHi","6144:I8SbHin","6144:8SbHinW","6144:SbHinW9","6144:bHinW9g","6144:HinW9gg","6144:inW9gg+","6144:nW9gg+4","6144:W9gg+4o","6144:9gg+4o3","6144:gg+4o3A","6144:g+4o3AK","6144:+4o3AKl","6144:4o3AKlj","6144:o3AKljK","6144:3AKljKl","6144:AKljKlt","6144:KljKltC","6144:ljKltCT","6144:jKltCTV","6144:KltCTVp","6144:ltCTVps","6144:tCTVpsN","6144:CTVpsNz","6144:TVpsNzM","6144:VpsNzMt","6144:psNzMtw","6144:sNzMtwa","6144:NzMtwaN","6144:zMtwaN9","6144:MtwaN9p","6144:twaN9py","6144:waN9pyc","6144:aN9pycD","6144:N9pycD8","6144:9pycD8Y","3072:v8THSbH","3072:8THSbHe","3072:THSbHeW","3072:HSbHeWN","3072:SbHeWNa","3072:bHeWNal","3072:HeWNalu","3072:eWNaluv","3072:WNaluvy","3072:NaluvyV","3072:aluvyVR","3072:luvyVRy","3072:uvyVRyI","3072:vyVRyI9","3072:yVRyI9W","3072:VRyI9WY"],"imphash":"57633c57ac8f1dec614ade0d941ba024"},"file_info":{"file_name":"tOldHSYWDVTCGAtymDVTCGAtym","file_type":["peexe","executable"],"file_type_id":"exe","file_size":155648,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1513953820000,"last_seen":1787852648000,"last_multi_scan":1787852648000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":24},"sandbox_signatures":{"informative_count":44,"suspicious_count":10,"malicious_count":6,"total":60},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/MalPe34.Suspicious.X2029","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.BWU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.BWU (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.GBFY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"W32.GenKryptik.BJSZ.lqod","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.Gen.cc!s4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/Obfuscator.gen!C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005d501a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"section_entropy_high","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Ransom-FN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericR-NGK!3C701AA97F42","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Ransom.IV.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MulDrop7.DDUU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Crypmod.Win32.475","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"GlobeImposter","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Able to retrieve event logs (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeNameW\" (Indicator: \"LookupPrivilegeNameW\"; Source: \"sample.bin\"), Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to retrieve event logs (API string)","description":"Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.001","id":"string-237","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetSecurityDescriptorControl\" (Indicator: \"SetSecurityDescriptorControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandleExW\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\"), Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"sample.bin\"), Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpQueryDataAvailable\" (Indicator: \"WinHttpQueryDataAvailable\"; Source: \"sample.bin\"), Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; Source: \"sample.bin\"), Found reference to API \"WinHttpQueryOption\" (Indicator: \"WinHttpQueryOption\"; Source: \"sample.bin\"), Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-323","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"11.0.0.1\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateSystemShutdownA\" (Indicator: \"InitiateSystemShutdown\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetUserObjectInformationW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\"), Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"sample.bin\"), Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 21244-676-00407986","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$28","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"OneDrive.lnk\" has type \"data\"\n \"Desktop.lnk\" has type \"data\"\n \"Downloads.lnk\" has type \"data\"\n \"Acrobat Reader DC.lnk\" has type \"data\"\n \"Mozilla Firefox.lnk\" has type \"data\"\n \"RecentPlaces.lnk\" has type \"data\"\n \"Read___ME.html\" has type \"HTML document ASCII text with very long lines with CRLF LF line terminators\"\n \"MSNBC News.url\" has type \"data\"\n \"AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg\" has type \"data\"\n \"Microsoft Store.url\" has type \"data\"\n \"Windows Live Spaces.url\" has type \"data\"\n \"ntuser.ini\" has type \"data\"\n \"1616.net.url\" has type \"data\"\n \"MSN Money.url\" has type \"data\"\n \"Desert.jpg\" has type \"data\"\n \"Sleep Away.mp3\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/TR/html4/strict.dtd\"\n Pattern match: \"https://www.torproject.org/projects/torbrowser.html.en\"\n Pattern match: \"http://n224ezvhg4sgyamb.onion/sup.php\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704.exe.bin\" was detected as \"Microsoft visual C++ 8\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Writes to a desktop.ini file (may be used to cloak folders)","description":"$29","origin":"API Call","relevance":3,"id":"api-34","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.27740739478","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Recorded TV\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Recorded TV\\Sample Media\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%APPDATA%\\15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"

Your files are Encrypted!

\" (Source: Read___ME.html, Indicator: \"files are encrypted\")\n \" dftw

Your files are Encrypted!

\" created file \"%APPDATA%\\15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/67 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/67 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00014434-00003440-6294-268-00403D04","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"klmqz.doc\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]}],"intel_graph":{"map":{"File:035f271fb08dd66d8ab0ca0d7d128ff0d34edfb23e31b79022175f50f3f257bd":{"type":"File","value":"035f271fb08dd66d8ab0ca0d7d128ff0d34edfb23e31b79022175f50f3f257bd"},"File:06bb54da2e479e35dda0f33da61e1901b798f630896097405fec1b9603310dcf":{"type":"File","value":"06bb54da2e479e35dda0f33da61e1901b798f630896097405fec1b9603310dcf"},"File:0b3dd02a64296f8836f0a3c85e3a2f14d19b50ba14d7b6e309fea3f3383c1a1d":{"type":"File","value":"0b3dd02a64296f8836f0a3c85e3a2f14d19b50ba14d7b6e309fea3f3383c1a1d"},"File:0b4249176132d6d63d4fe86e7e1828c470707053b5b63189631eec92a985ff94":{"type":"File","value":"0b4249176132d6d63d4fe86e7e1828c470707053b5b63189631eec92a985ff94"},"File:0b64f7137fb5ee8f966baa2377a3c066eb5ef66f7c41569569af15a7219d0c37":{"type":"File","value":"0b64f7137fb5ee8f966baa2377a3c066eb5ef66f7c41569569af15a7219d0c37"},"File:0cbb1adff37a803424ef8616fd2cf0fffadeaef3262ed7a902d3196bb2291c2f":{"type":"File","value":"0cbb1adff37a803424ef8616fd2cf0fffadeaef3262ed7a902d3196bb2291c2f"},"File:0fff863dca13f332e1e33ea095b3c93db81ec4804a7217f243fb6540e048c4a3":{"type":"File","value":"0fff863dca13f332e1e33ea095b3c93db81ec4804a7217f243fb6540e048c4a3"},"File:13a928fd7adacffd94da47ee267c1ba28de13214a09874609ec5a1c6b578ae22":{"type":"File","value":"13a928fd7adacffd94da47ee267c1ba28de13214a09874609ec5a1c6b578ae22"},"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704":{"type":"File","value":"15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat GlobeImposter"]}},"File:1652ae01bb44ca523712ca447cf091671e09ade3515932ec57ea196fae196d93":{"type":"File","value":"1652ae01bb44ca523712ca447cf091671e09ade3515932ec57ea196fae196d93"},"File:19ef75c3d36cd88e95123ed69465a4b9afcadf67c92342626dba31294cca37ce":{"type":"File","value":"19ef75c3d36cd88e95123ed69465a4b9afcadf67c92342626dba31294cca37ce"},"File:1d29c1350068407bab3f0034701bc09d6f69f9d3f40c2a8b47bc6592b50a11ca":{"type":"File","value":"1d29c1350068407bab3f0034701bc09d6f69f9d3f40c2a8b47bc6592b50a11ca"},"File:1ebe9f94ba0b07c43f21820fa138a20c707a902291256040b7ade0fbf2b9d483":{"type":"File","value":"1ebe9f94ba0b07c43f21820fa138a20c707a902291256040b7ade0fbf2b9d483"},"File:215c51520cc7950ac449360e109e157b324ee96091b1452d5b13b6432051d8b9":{"type":"File","value":"215c51520cc7950ac449360e109e157b324ee96091b1452d5b13b6432051d8b9"},"File:2965559c81fa7572307edc715063f8e1b3bce844d68675efbefbf9b9ec7798ad":{"type":"File","value":"2965559c81fa7572307edc715063f8e1b3bce844d68675efbefbf9b9ec7798ad"},"File:29b8ee277475fd6d1bf4b0aec281c00ea2a52b3a2dcead93772734f7defcb020":{"type":"File","value":"29b8ee277475fd6d1bf4b0aec281c00ea2a52b3a2dcead93772734f7defcb020"},"File:2d5f60e5f4a590962d845a33bddcbe88c3d2e2b1eb72bde6c7ca4d061495358f":{"type":"File","value":"2d5f60e5f4a590962d845a33bddcbe88c3d2e2b1eb72bde6c7ca4d061495358f"},"File:300fdcb905eed5c0f9d58a2a0882e2d53ed8a765fdd41fcd8db0ed764ff0b839":{"type":"File","value":"300fdcb905eed5c0f9d58a2a0882e2d53ed8a765fdd41fcd8db0ed764ff0b839"},"File:3119ee6ac667310f6efb9c08c4809c984d7b201831bb909f97ca23d7a9c523f5":{"type":"File","value":"3119ee6ac667310f6efb9c08c4809c984d7b201831bb909f97ca23d7a9c523f5"},"File:392f1064970d3060b1978a39c9304c03701dab17954664fa29b197e534592c38":{"type":"File","value":"392f1064970d3060b1978a39c9304c03701dab17954664fa29b197e534592c38"},"File:3b1c51b7e6f400c0f11cd654ec45dd1d16fa1101895109dd687ce32982d0663e":{"type":"File","value":"3b1c51b7e6f400c0f11cd654ec45dd1d16fa1101895109dd687ce32982d0663e"},"File:3baaeacdaba2d1641a912d8f073c2a0d83f70d5ad15fa2ee2579e39d936217bd":{"type":"File","value":"3baaeacdaba2d1641a912d8f073c2a0d83f70d5ad15fa2ee2579e39d936217bd"},"File:3d39df7c8a98afbeb4ab26c9db96ba03e8c2d37f1893a45443077dff57cc1df5":{"type":"File","value":"3d39df7c8a98afbeb4ab26c9db96ba03e8c2d37f1893a45443077dff57cc1df5"},"File:4ef484effb5c498b13a683df9189042474d338402f1e0a08efbb0d3687fa3a1c":{"type":"File","value":"4ef484effb5c498b13a683df9189042474d338402f1e0a08efbb0d3687fa3a1c"},"File:4f64c5451adb36407a5d24b3feee635120130f6d04dca8ae617696f433cd19da":{"type":"File","value":"4f64c5451adb36407a5d24b3feee635120130f6d04dca8ae617696f433cd19da"},"File:4ff1549eedaadbe342bdeacb4856c746636f71debc9b55853c384187232e7bb9":{"type":"File","value":"4ff1549eedaadbe342bdeacb4856c746636f71debc9b55853c384187232e7bb9"},"File:5a078edd67f4e4a5a2b04d136ca1312e4f2f00b1d126d8d147f15ccc0c929715":{"type":"File","value":"5a078edd67f4e4a5a2b04d136ca1312e4f2f00b1d126d8d147f15ccc0c929715"},"File:5a44d07e439933c3b64884573ade858a0dab5d6a5263473d17746fc91d550dc3":{"type":"File","value":"5a44d07e439933c3b64884573ade858a0dab5d6a5263473d17746fc91d550dc3"},"File:645c1c0bcfa72c7cc0ae72cdf95f9ed5a9998d932669c17df669d9889f6465ec":{"type":"File","value":"645c1c0bcfa72c7cc0ae72cdf95f9ed5a9998d932669c17df669d9889f6465ec"},"File:69e1443953176b13d973c4a3a599ce35e7733101d93696d3fd8f304e5d8ad0aa":{"type":"File","value":"69e1443953176b13d973c4a3a599ce35e7733101d93696d3fd8f304e5d8ad0aa"},"File:6cb468da7337de08a5978160dadcfafd61951b86e636b36c138c2624916e6a0c":{"type":"File","value":"6cb468da7337de08a5978160dadcfafd61951b86e636b36c138c2624916e6a0c"},"File:6e6094aa009e0221877eabfb59c7e6560f5062701f313e647599fdd1eda2f633":{"type":"File","value":"6e6094aa009e0221877eabfb59c7e6560f5062701f313e647599fdd1eda2f633"},"File:745ec7b169f989aec100bf1296e90c4e064a5d8af925cfa60467f4a82b4f4a42":{"type":"File","value":"745ec7b169f989aec100bf1296e90c4e064a5d8af925cfa60467f4a82b4f4a42"},"File:768ce1d46ec05be635f2aa2db1b8e62dbc65a734352a7af6ac1365e0b0dba685":{"type":"File","value":"768ce1d46ec05be635f2aa2db1b8e62dbc65a734352a7af6ac1365e0b0dba685"},"File:7b09671f5e0fcd349138675bfe0c0c5bae013d31c7be69067b556ca465774638":{"type":"File","value":"7b09671f5e0fcd349138675bfe0c0c5bae013d31c7be69067b556ca465774638"},"File:7b653e7375f8a838541eabfdcdde3c775ef2a07a7a26e192f1a929e1772dac8d":{"type":"File","value":"7b653e7375f8a838541eabfdcdde3c775ef2a07a7a26e192f1a929e1772dac8d"},"File:7bf7793b907079fb6f9d2ce5d6c1cecaf6d6f679a931e15ebee1c8f7246ad1c3":{"type":"File","value":"7bf7793b907079fb6f9d2ce5d6c1cecaf6d6f679a931e15ebee1c8f7246ad1c3"},"File:8528db93bca37103a7efa94fa05346b3dff5d723178b5f2dc2fbbb69eadd882d":{"type":"File","value":"8528db93bca37103a7efa94fa05346b3dff5d723178b5f2dc2fbbb69eadd882d"},"File:87704c5133e29ecbf91b54f63b350fa69fdb863c3c46363739ffcc12e3f98f44":{"type":"File","value":"87704c5133e29ecbf91b54f63b350fa69fdb863c3c46363739ffcc12e3f98f44"},"File:884e6a11641efd7bd3e87511d1366611a69fe7d22e1f8a27dac2fdaac9dc94c1":{"type":"File","value":"884e6a11641efd7bd3e87511d1366611a69fe7d22e1f8a27dac2fdaac9dc94c1"},"File:8dec13c82dfd4aa9259a8e044c775ffe774858549f5726aa7e6652773a88a295":{"type":"File","value":"8dec13c82dfd4aa9259a8e044c775ffe774858549f5726aa7e6652773a88a295"},"File:959cc9cf82ffbfbb6fa27d0d21646c1d66e415eb67acd1e3dbdd622178aeae65":{"type":"File","value":"959cc9cf82ffbfbb6fa27d0d21646c1d66e415eb67acd1e3dbdd622178aeae65"},"File:99249c6496097f31022efee25e84c3956152443860361c5f3ab86f53cade14eb":{"type":"File","value":"99249c6496097f31022efee25e84c3956152443860361c5f3ab86f53cade14eb"},"File:99bfc7577655a12f370912ac02292359670d9f964439dcfefc9529dc76a78eed":{"type":"File","value":"99bfc7577655a12f370912ac02292359670d9f964439dcfefc9529dc76a78eed"},"File:9a4d86545105d459a748e38efb06620c57b566211bb1397f8331b6489ad4e25b":{"type":"File","value":"9a4d86545105d459a748e38efb06620c57b566211bb1397f8331b6489ad4e25b"},"File:9b7568750398acf0f61817af2a1e476a0244d615cd26edba5ee5fb6fb6e29ce7":{"type":"File","value":"9b7568750398acf0f61817af2a1e476a0244d615cd26edba5ee5fb6fb6e29ce7"},"File:9dd271c111e4aa2b8004ed3b6405c75206fa40d280186f710075b53d288a2bcf":{"type":"File","value":"9dd271c111e4aa2b8004ed3b6405c75206fa40d280186f710075b53d288a2bcf"},"File:9e8417d6c79abd10059176f4fb9066fac0259a0a875df66320d5de6956dcf0ae":{"type":"File","value":"9e8417d6c79abd10059176f4fb9066fac0259a0a875df66320d5de6956dcf0ae"},"File:a8b1b2145fe0712c07331c7d1aa44995a5535ed3fd244b22aef54ca77a76617a":{"type":"File","value":"a8b1b2145fe0712c07331c7d1aa44995a5535ed3fd244b22aef54ca77a76617a"},"File:aab414c20c07ad909dcaf89a42213c2d0284ba9cdbccf6a6bc61ba03787e59ea":{"type":"File","value":"aab414c20c07ad909dcaf89a42213c2d0284ba9cdbccf6a6bc61ba03787e59ea"},"File:ade849e32989233021c18601aa6bb6c01f0dbb71da126ee326eca10184de8876":{"type":"File","value":"ade849e32989233021c18601aa6bb6c01f0dbb71da126ee326eca10184de8876"},"File:b033d8825b953f5918bdba8320118f00d1d09436cd4c57b03a26ae60bc0a000f":{"type":"File","value":"b033d8825b953f5918bdba8320118f00d1d09436cd4c57b03a26ae60bc0a000f"},"File:b2651bd7870422895709d046db9fd97d867c2320578e5c8ebd0aa880d77f7505":{"type":"File","value":"b2651bd7870422895709d046db9fd97d867c2320578e5c8ebd0aa880d77f7505"},"File:b3f38ba1bdb53ed806097e8ccb40985202443a0a11056924b741c2ce424129f7":{"type":"File","value":"b3f38ba1bdb53ed806097e8ccb40985202443a0a11056924b741c2ce424129f7"},"File:b88a0d7ea66a38f13cd4ea53dcf5ea7983e562eb19d973564e4f630acd55afb8":{"type":"File","value":"b88a0d7ea66a38f13cd4ea53dcf5ea7983e562eb19d973564e4f630acd55afb8"},"File:d066338b93e4b0e3a4e76ef07cea0aa2f48b0f37cdf320c42c53e7e4898d8cbc":{"type":"File","value":"d066338b93e4b0e3a4e76ef07cea0aa2f48b0f37cdf320c42c53e7e4898d8cbc"},"File:e682ec493d972d81b799a9dc1855d92615866fa105d77b977c04a37a04e0f368":{"type":"File","value":"e682ec493d972d81b799a9dc1855d92615866fa105d77b977c04a37a04e0f368"},"File:ea621492b45b86017a61a88d7a3da07b564abbf59709e26e67b937be516b12e1":{"type":"File","value":"ea621492b45b86017a61a88d7a3da07b564abbf59709e26e67b937be516b12e1"},"File:ec9176ea041fa7e202686c1f8a4a66bc46ee7f43a9d62687d72a93d6e04a0f9f":{"type":"File","value":"ec9176ea041fa7e202686c1f8a4a66bc46ee7f43a9d62687d72a93d6e04a0f9f"},"File:ee1a399b4e4c644e4907bae1a05a458da118505b78e988066cffa29dc8a3634f":{"type":"File","value":"ee1a399b4e4c644e4907bae1a05a458da118505b78e988066cffa29dc8a3634f"},"File:eef8b260f6b5c8c37966a118ac84c8294743c02e7087ac086f7a4b7783aa6907":{"type":"File","value":"eef8b260f6b5c8c37966a118ac84c8294743c02e7087ac086f7a4b7783aa6907"},"File:f303a89ffe43c1f3cf61e1c08ca0bec21858f56626e7e9e72e67891424977073":{"type":"File","value":"f303a89ffe43c1f3cf61e1c08ca0bec21858f56626e7e9e72e67891424977073"},"File:f592834e0359dce08f72d438d28ed1073fa852fd0435d76e85505a560ddbd950":{"type":"File","value":"f592834e0359dce08f72d438d28ed1073fa852fd0435d76e85505a560ddbd950"},"File:f867427c81aa81d8b983a43f32a51a6f8b2a53c7757a4264792de6cc6ae2bdd1":{"type":"File","value":"f867427c81aa81d8b983a43f32a51a6f8b2a53c7757a4264792de6cc6ae2bdd1"},"File:f8ff7b14378cbfe56a3436f691a7b05229f488c065b1038b471fb7694b858738":{"type":"File","value":"f8ff7b14378cbfe56a3436f691a7b05229f488c065b1038b471fb7694b858738"},"File:faefb7482cfd26ddf07ea5485ac326754459789f157b6114adb3f56bd6e3fe54":{"type":"File","value":"faefb7482cfd26ddf07ea5485ac326754459789f157b6114adb3f56bd6e3fe54"},"Threat:765df5bd048ad3625ced4a3693e3c447c824dbab926351801b24d7d4790d5cfd":{"type":"Threat","value":"GlobeImposter","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1542590573797568998","root":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat GlobeImposter"]}},{"id":"1542590573793374693","root":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"Threat:765df5bd048ad3625ced4a3693e3c447c824dbab926351801b24d7d4790d5cfd"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_files","root":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","edges":[{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:035f271fb08dd66d8ab0ca0d7d128ff0d34edfb23e31b79022175f50f3f257bd"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:f867427c81aa81d8b983a43f32a51a6f8b2a53c7757a4264792de6cc6ae2bdd1"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:f8ff7b14378cbfe56a3436f691a7b05229f488c065b1038b471fb7694b858738"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:0cbb1adff37a803424ef8616fd2cf0fffadeaef3262ed7a902d3196bb2291c2f"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:b88a0d7ea66a38f13cd4ea53dcf5ea7983e562eb19d973564e4f630acd55afb8"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:959cc9cf82ffbfbb6fa27d0d21646c1d66e415eb67acd1e3dbdd622178aeae65"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:3119ee6ac667310f6efb9c08c4809c984d7b201831bb909f97ca23d7a9c523f5"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:faefb7482cfd26ddf07ea5485ac326754459789f157b6114adb3f56bd6e3fe54"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:f592834e0359dce08f72d438d28ed1073fa852fd0435d76e85505a560ddbd950"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:4ff1549eedaadbe342bdeacb4856c746636f71debc9b55853c384187232e7bb9"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:aab414c20c07ad909dcaf89a42213c2d0284ba9cdbccf6a6bc61ba03787e59ea"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:0b4249176132d6d63d4fe86e7e1828c470707053b5b63189631eec92a985ff94"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:29b8ee277475fd6d1bf4b0aec281c00ea2a52b3a2dcead93772734f7defcb020"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:13a928fd7adacffd94da47ee267c1ba28de13214a09874609ec5a1c6b578ae22"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:3d39df7c8a98afbeb4ab26c9db96ba03e8c2d37f1893a45443077dff57cc1df5"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:3baaeacdaba2d1641a912d8f073c2a0d83f70d5ad15fa2ee2579e39d936217bd"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:ade849e32989233021c18601aa6bb6c01f0dbb71da126ee326eca10184de8876"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:6cb468da7337de08a5978160dadcfafd61951b86e636b36c138c2624916e6a0c"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:2d5f60e5f4a590962d845a33bddcbe88c3d2e2b1eb72bde6c7ca4d061495358f"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:745ec7b169f989aec100bf1296e90c4e064a5d8af925cfa60467f4a82b4f4a42"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:6e6094aa009e0221877eabfb59c7e6560f5062701f313e647599fdd1eda2f633"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:5a078edd67f4e4a5a2b04d136ca1312e4f2f00b1d126d8d147f15ccc0c929715"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:ec9176ea041fa7e202686c1f8a4a66bc46ee7f43a9d62687d72a93d6e04a0f9f"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:9dd271c111e4aa2b8004ed3b6405c75206fa40d280186f710075b53d288a2bcf"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:3b1c51b7e6f400c0f11cd654ec45dd1d16fa1101895109dd687ce32982d0663e"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:215c51520cc7950ac449360e109e157b324ee96091b1452d5b13b6432051d8b9"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:99249c6496097f31022efee25e84c3956152443860361c5f3ab86f53cade14eb"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:ee1a399b4e4c644e4907bae1a05a458da118505b78e988066cffa29dc8a3634f"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:9b7568750398acf0f61817af2a1e476a0244d615cd26edba5ee5fb6fb6e29ce7"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:b3f38ba1bdb53ed806097e8ccb40985202443a0a11056924b741c2ce424129f7"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:b2651bd7870422895709d046db9fd97d867c2320578e5c8ebd0aa880d77f7505"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:8dec13c82dfd4aa9259a8e044c775ffe774858549f5726aa7e6652773a88a295"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:87704c5133e29ecbf91b54f63b350fa69fdb863c3c46363739ffcc12e3f98f44"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:06bb54da2e479e35dda0f33da61e1901b798f630896097405fec1b9603310dcf"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:9a4d86545105d459a748e38efb06620c57b566211bb1397f8331b6489ad4e25b"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:4ef484effb5c498b13a683df9189042474d338402f1e0a08efbb0d3687fa3a1c"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:1d29c1350068407bab3f0034701bc09d6f69f9d3f40c2a8b47bc6592b50a11ca"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:ea621492b45b86017a61a88d7a3da07b564abbf59709e26e67b937be516b12e1"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:0b3dd02a64296f8836f0a3c85e3a2f14d19b50ba14d7b6e309fea3f3383c1a1d"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:5a44d07e439933c3b64884573ade858a0dab5d6a5263473d17746fc91d550dc3"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:7b653e7375f8a838541eabfdcdde3c775ef2a07a7a26e192f1a929e1772dac8d"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:768ce1d46ec05be635f2aa2db1b8e62dbc65a734352a7af6ac1365e0b0dba685"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:8528db93bca37103a7efa94fa05346b3dff5d723178b5f2dc2fbbb69eadd882d"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:99bfc7577655a12f370912ac02292359670d9f964439dcfefc9529dc76a78eed"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:a8b1b2145fe0712c07331c7d1aa44995a5535ed3fd244b22aef54ca77a76617a"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:b033d8825b953f5918bdba8320118f00d1d09436cd4c57b03a26ae60bc0a000f"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:d066338b93e4b0e3a4e76ef07cea0aa2f48b0f37cdf320c42c53e7e4898d8cbc"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:7b09671f5e0fcd349138675bfe0c0c5bae013d31c7be69067b556ca465774638"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:69e1443953176b13d973c4a3a599ce35e7733101d93696d3fd8f304e5d8ad0aa"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:0b64f7137fb5ee8f966baa2377a3c066eb5ef66f7c41569569af15a7219d0c37"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:645c1c0bcfa72c7cc0ae72cdf95f9ed5a9998d932669c17df669d9889f6465ec"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:e682ec493d972d81b799a9dc1855d92615866fa105d77b977c04a37a04e0f368"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:f303a89ffe43c1f3cf61e1c08ca0bec21858f56626e7e9e72e67891424977073"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:9e8417d6c79abd10059176f4fb9066fac0259a0a875df66320d5de6956dcf0ae"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:2965559c81fa7572307edc715063f8e1b3bce844d68675efbefbf9b9ec7798ad"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:1652ae01bb44ca523712ca447cf091671e09ade3515932ec57ea196fae196d93"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:19ef75c3d36cd88e95123ed69465a4b9afcadf67c92342626dba31294cca37ce"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:4f64c5451adb36407a5d24b3feee635120130f6d04dca8ae617696f433cd19da"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:300fdcb905eed5c0f9d58a2a0882e2d53ed8a765fdd41fcd8db0ed764ff0b839"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:884e6a11641efd7bd3e87511d1366611a69fe7d22e1f8a27dac2fdaac9dc94c1"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:1ebe9f94ba0b07c43f21820fa138a20c707a902291256040b7ade0fbf2b9d483"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:7bf7793b907079fb6f9d2ce5d6c1cecaf6d6f679a931e15ebee1c8f7246ad1c3"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:392f1064970d3060b1978a39c9304c03701dab17954664fa29b197e534592c38"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:0fff863dca13f332e1e33ea095b3c93db81ec4804a7217f243fb6540e048c4a3"},{"edge_kind":"extracted","from_key":"File:15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","to_key":"File:eef8b260f6b5c8c37966a118ac84c8294743c02e7087ac086f7a4b7783aa6907"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":26,"dropped_files_count":0,"extracted_files_count":65,"files_written_count":72,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5a3d2cd57ca3e14ef077fcc4","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","submit_name":"tOldHSYW","analysis_start_time":"2017-12-22T17:03:51+00:00","indicators_count":{"informative":7,"suspicious":8,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5a3d17487ca3e11d9c05ae23","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":77,"malware_family":"Kryptik.GASG","submit_name":"tOldHSYWDVTCGAtymDVTCGAtym","analysis_start_time":"2017-12-22T15:31:40+00:00","indicators_count":{"informative":7,"suspicious":10,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}],"processes":[{"pid":2500,"ppid":0,"name":"15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704.exe","command_line":"","sha256":"15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704","normalized_path":"C:\\15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704.exe","uid":"00010948-00002500","icon":"$2b"}],"all_imported_dlls":["rpcrt4.dll","winhttp.dll","msctf.dll","shell32.dll","shlwapi.dll","rsaenh.dll","ntdll.dll","wow64cpu.dll","lpk.dll","msvcrt.dll","sspicli.dll","wow64win.dll","kernel32.dll","user32.dll","cryptbase.dll","msimg32.dll","imm32.dll","msvcr100.dll","cryptsp.dll","advapi32.dll","sechost.dll","wow64.dll","KernelBase.dll","gdi32.dll","usp10.dll","webio.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"Read___ME.html","sha256":"035f271fb08dd66d8ab0ca0d7d128ff0d34edfb23e31b79022175f50f3f257bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"AE09C984DF6E74640B3271EADB5DD7C65FDE806235B2CDA478E0EFA9129C09E7","sha256":"f867427c81aa81d8b983a43f32a51a6f8b2a53c7757a4264792de6cc6ae2bdd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"Acrobat Reader DC.lnk","sha256":"f8ff7b14378cbfe56a3436f691a7b05229f488c065b1038b471fb7694b858738","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Mozilla Firefox.lnk","sha256":"0cbb1adff37a803424ef8616fd2cf0fffadeaef3262ed7a902d3196bb2291c2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"RecordedTV.library-ms","sha256":"b88a0d7ea66a38f13cd4ea53dcf5ea7983e562eb19d973564e4f630acd55afb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg","sha256":"959cc9cf82ffbfbb6fa27d0d21646c1d66e415eb67acd1e3dbdd622178aeae65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg","sha256":"3119ee6ac667310f6efb9c08c4809c984d7b201831bb909f97ca23d7a9c523f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Maid with the Flaxen Hair.mp3","sha256":"faefb7482cfd26ddf07ea5485ac326754459789f157b6114adb3f56bd6e3fe54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Sleep Away.mp3","sha256":"f592834e0359dce08f72d438d28ed1073fa852fd0435d76e85505a560ddbd950","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Chrysanthemum.jpg","sha256":"4ff1549eedaadbe342bdeacb4856c746636f71debc9b55853c384187232e7bb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Desert.jpg","sha256":"aab414c20c07ad909dcaf89a42213c2d0284ba9cdbccf6a6bc61ba03787e59ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Hydrangeas.jpg","sha256":"0b4249176132d6d63d4fe86e7e1828c470707053b5b63189631eec92a985ff94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Jellyfish.jpg","sha256":"29b8ee277475fd6d1bf4b0aec281c00ea2a52b3a2dcead93772734f7defcb020","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Koala.jpg","sha256":"13a928fd7adacffd94da47ee267c1ba28de13214a09874609ec5a1c6b578ae22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Lighthouse.jpg","sha256":"3d39df7c8a98afbeb4ab26c9db96ba03e8c2d37f1893a45443077dff57cc1df5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Penguins.jpg","sha256":"3baaeacdaba2d1641a912d8f073c2a0d83f70d5ad15fa2ee2579e39d936217bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Tulips.jpg","sha256":"ade849e32989233021c18601aa6bb6c01f0dbb71da126ee326eca10184de8876","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"GobiernoUSA.gov.url","sha256":"6cb468da7337de08a5978160dadcfafd61951b86e636b36c138c2624916e6a0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"USA.gov.url","sha256":"2d5f60e5f4a590962d845a33bddcbe88c3d2e2b1eb72bde6c7ca4d061495358f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"1616.net.url","sha256":"745ec7b169f989aec100bf1296e90c4e064a5d8af925cfa60467f4a82b4f4a42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"Desktop.lnk","sha256":"6e6094aa009e0221877eabfb59c7e6560f5062701f313e647599fdd1eda2f633","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"Downloads.lnk","sha256":"5a078edd67f4e4a5a2b04d136ca1312e4f2f00b1d126d8d147f15ccc0c929715","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"OneDrive.lnk","sha256":"ec9176ea041fa7e202686c1f8a4a66bc46ee7f43a9d62687d72a93d6e04a0f9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"name":"RecentPlaces.lnk","sha256":"9dd271c111e4aa2b8004ed3b6405c75206fa40d280186f710075b53d288a2bcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"01dMtnkBz9.gif","sha256":"3b1c51b7e6f400c0f11cd654ec45dd1d16fa1101895109dd687ce32982d0663e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"04bZ.txt","sha256":"215c51520cc7950ac449360e109e157b324ee96091b1452d5b13b6432051d8b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"0Og1.rar","sha256":"99249c6496097f31022efee25e84c3956152443860361c5f3ab86f53cade14eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"ee1a399b4e4c644e4907bae1a05a458da118505b78e988066cffa29dc8a3634f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"9b7568750398acf0f61817af2a1e476a0244d615cd26edba5ee5fb6fb6e29ce7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"0zIG0D.doc","sha256":"b3f38ba1bdb53ed806097e8ccb40985202443a0a11056924b741c2ce424129f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"1N1A3vlRdYRii5C.mp3","sha256":"b2651bd7870422895709d046db9fd97d867c2320578e5c8ebd0aa880d77f7505","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"1q4yvQVxByym4.rar","sha256":"8dec13c82dfd4aa9259a8e044c775ffe774858549f5726aa7e6652773a88a295","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"3AVoUo9c20GI.pdf","sha256":"87704c5133e29ecbf91b54f63b350fa69fdb863c3c46363739ffcc12e3f98f44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"3Awf.mp3","sha256":"06bb54da2e479e35dda0f33da61e1901b798f630896097405fec1b9603310dcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"3dfFyhzUJVQSk.img","sha256":"9a4d86545105d459a748e38efb06620c57b566211bb1397f8331b6489ad4e25b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"4lpro8p6KuJo0.mp3","sha256":"4ef484effb5c498b13a683df9189042474d338402f1e0a08efbb0d3687fa3a1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"4nAn3p.mp3","sha256":"1d29c1350068407bab3f0034701bc09d6f69f9d3f40c2a8b47bc6592b50a11ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"ea621492b45b86017a61a88d7a3da07b564abbf59709e26e67b937be516b12e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"5aFd8vA3PE3A.mp3","sha256":"0b3dd02a64296f8836f0a3c85e3a2f14d19b50ba14d7b6e309fea3f3383c1a1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"5yqb2pxbZ.txt","sha256":"5a44d07e439933c3b64884573ade858a0dab5d6a5263473d17746fc91d550dc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"7b653e7375f8a838541eabfdcdde3c775ef2a07a7a26e192f1a929e1772dac8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"66u5Ps.pdf","sha256":"768ce1d46ec05be635f2aa2db1b8e62dbc65a734352a7af6ac1365e0b0dba685","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"6SZfLTu9z.doc","sha256":"8528db93bca37103a7efa94fa05346b3dff5d723178b5f2dc2fbbb69eadd882d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"99bfc7577655a12f370912ac02292359670d9f964439dcfefc9529dc76a78eed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"a8b1b2145fe0712c07331c7d1aa44995a5535ed3fd244b22aef54ca77a76617a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"C04T72pR0Bcl.doc","sha256":"b033d8825b953f5918bdba8320118f00d1d09436cd4c57b03a26ae60bc0a000f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"EKeaJO.doc","sha256":"d066338b93e4b0e3a4e76ef07cea0aa2f48b0f37cdf320c42c53e7e4898d8cbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"F3hzum1.doc","sha256":"7b09671f5e0fcd349138675bfe0c0c5bae013d31c7be69067b556ca465774638","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"a3Ntx.exe","sha256":"69e1443953176b13d973c4a3a599ce35e7733101d93696d3fd8f304e5d8ad0aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"bg3oTe.doc","sha256":"0b64f7137fb5ee8f966baa2377a3c066eb5ef66f7c41569569af15a7219d0c37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"bvYkKJ33N9A.exe","sha256":"645c1c0bcfa72c7cc0ae72cdf95f9ed5a9998d932669c17df669d9889f6465ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"dH1rDN9f9.doc","sha256":"e682ec493d972d81b799a9dc1855d92615866fa105d77b977c04a37a04e0f368","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"dgQJde60mPXhI.exe","sha256":"f303a89ffe43c1f3cf61e1c08ca0bec21858f56626e7e9e72e67891424977073","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"dskCEJ.exe","sha256":"9e8417d6c79abd10059176f4fb9066fac0259a0a875df66320d5de6956dcf0ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"hKY8.doc","sha256":"2965559c81fa7572307edc715063f8e1b3bce844d68675efbefbf9b9ec7798ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"hlchPBL.exe","sha256":"1652ae01bb44ca523712ca447cf091671e09ade3515932ec57ea196fae196d93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"iLLOga.exe","sha256":"19ef75c3d36cd88e95123ed69465a4b9afcadf67c92342626dba31294cca37ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"kY01UeAiy5.exe","sha256":"4f64c5451adb36407a5d24b3feee635120130f6d04dca8ae617696f433cd19da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"300fdcb905eed5c0f9d58a2a0882e2d53ed8a765fdd41fcd8db0ed764ff0b839","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"klmqz.doc","sha256":"884e6a11641efd7bd3e87511d1366611a69fe7d22e1f8a27dac2fdaac9dc94c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"1ebe9f94ba0b07c43f21820fa138a20c707a902291256040b7ade0fbf2b9d483","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"mtgFs8Za.doc","sha256":"7bf7793b907079fb6f9d2ce5d6c1cecaf6d6f679a931e15ebee1c8f7246ad1c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"rRgk91Ih5n.doc","sha256":"392f1064970d3060b1978a39c9304c03701dab17954664fa29b197e534592c38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"tDUzYwYK5f.exe","sha256":"0fff863dca13f332e1e33ea095b3c93db81ec4804a7217f243fb6540e048c4a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"name":"autoexec.bat","sha256":"eef8b260f6b5c8c37966a118ac84c8294743c02e7087ac086f7a4b7783aa6907","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704.exe","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%APPDATA%\\15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704.exe","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%APPDATA%\\15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\AE09C984DF6E74640B3271EADB5DD7C65FDE806235B2CDA478E0EFA9129C09E7","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\share\\1513958652193$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"C:\\share\\1513958652193$OK","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"C:\\1513958652193$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"C:\\1513958652193$OK","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"C:\\y4l.TOM","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\LGC6w6aG2HoVa.6gs","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"C:\\PA7lmG4m0gOu7CQm4gXo.0LA","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"C:\\NvWfcNyZ8S3ErLO1QkTFcYGf.HWz","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"C:\\76kGkFxic.WXh","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"C:\\wEEpz2i1C.Hvb","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"C:\\Users\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%PUBLIC%\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Videos\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Recorded TV\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Pictures\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Music\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Libraries\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Downloads\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Documents\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%PUBLIC%\\Desktop\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%USERPROFILE%\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Videos\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Searches\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Saved Games\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Pictures\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\OneDrive\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%USERPROFILE%\\Music\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Links\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Favorites\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1616.net.url","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\share\\1513953122488$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\1513953122488$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\share\\1513953122488$OK","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\1513953122488$OK","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\te7.VqO","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\O34Byw2CV72xk.wIz","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\p9rxvFPBXqq5CtV6yh5J.IkL","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\us0yjh3GJBrtTEEZF1Fglvuf.GuS","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\46zdWJQOZ.FSP","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"C:\\rK1hAgnm8.LxP","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Downloads\\Read___ME.html","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]},{"path":"%USERPROFILE%\\Downloads\\tDUzYwYK5f.exe","sources":[{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5a3d2cd57ca3e14ef077fcc4"},{"report_type":"sandbox","report_id":"5a3d17487ca3e11d9c05ae23"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a3d2cd57ca3e14ef077fcc4","5a3d17487ca3e11d9c05ae23"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Ransom Sample 15e8c986c460… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 15e8c986c460…. Malware family: Trojan.Ransom. Threat score 100/100. 21/25 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom Sample 15e8c986c460… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 15e8c986c460…. Malware family: Trojan.Ransom. Threat score 100/100. 21/25 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom Sample 15e8c986c460… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 15e8c986c460…. Malware family: Trojan.Ransom. Threat score 100/100. 21/25 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]