23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T4a6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.53E2C665 Sample 1f8936ce65fd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1f8936ce65fd…. Malware family: Ransom.53E2C665. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5","keywords":["Malicious","Ransom.53E2C665","malware analysis","sandbox report","threat intelligence","1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5"],"about":{"@type":"SoftwareApplication","name":"vL7m34qWISaBkgLe1hhOVRMUGLvNUlTayOK.exe","applicationCategory":["peexe","executable"],"identifier":"1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.53E2C665","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:Tb9d,"" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\AdobeID.pdf" at 00014591-00003732-0000010C-46852925 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\DefaultID.pdf" at 00014591-00003732-0000010C-46856140 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\AdobeID.pdf" at 00014591-00003732-0000010C-46860273 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\DefaultID.pdf" at 00014591-00003732-0000010C-46863773 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf" at 00014591-00003732-0000010C-46908362 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\Dynamic.pdf" at 00014591-00003732-0000010C-46982608 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\SignHere.pdf" at 00014591-00003732-0000010C-46984842 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\StandardBusiness.pdf" at 00014591-00003732-0000010C-46987188 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" at 00014591-00003732-0000010C-46991009 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" at 00014591-00003732-0000010C-46993234 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" at 00014591-00003732-0000010C-46995491 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\Words.pdf" at 00014591-00003732-0000010C-46998282 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Resource\ENUtxt.pdf" at 00014591-00003732-0000010C-47043554 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt" at 00014591-00003732-0000010C-47072966 "" queries volume information of "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" at 00014591-00003732-0000010C-47074979 "" queries volume information of "C:\Program Files\AutoIt3\AutoItX\Examples\C++\_readme.txt" at 00014591-00003732-0000010C-47153293 "" queries volume information of "C:\Program Files\AutoIt3\AutoItX\Examples\VBScript\_readme.txt" at 00014591-00003732-0000010C-47159128 "" queries volume information of "C:\Program Files\AutoIt3\Examples\COM\Worksheet.xls" at 00014591-00003732-0000010C-4719841425:T7e9,"" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")26:T745,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")27:T6a5d,Heuristic match: "**big.Int" Heuristic match: "*pkix.Name" Heuristic match: "*reflect.name" Heuristic match: "*runtime.name" Pattern match: "github.com/kr/fs" Pattern match: "golang.org/x/sys/windows" Heuristic match: "*func(*big.Int) *big.Int" Pattern match: "golang.org/x/sys/windows/registry" Pattern match: "u4hp32ms2u6s4x7q.onion.casa/new_c/vL7m34qWISaBkgLe1hhOVRMUGLvNUlTayOK115792089210356248762697446949407573529996955224135760342422259061068512044369115792089210356248762697446949407573530086143415290314195533631308867097853951tls" Pattern match: "golang.org/s/cgihttpproxya" Pattern match: "https://u4hp32ms2u6s4x7q.onion.casa/decrypt/" Pattern match: "type..hash.sync/atomic.Value" Pattern match: "type..eq.sync/atomic.Value" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*Func).Name" Heuristic match: "runtime.name.name" Heuristic match: "sync.(*Once).Do" Heuristic match: "os.(*File).Name" Heuristic match: "os.(*fileStat).Name" Pattern match: "secure2.alphassl.com/cacert/gsalphasha2g2r1.crt05" Pattern match: "http://ocsp2.globalsign.com/gsalphasha2g20W" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "http://crl2.alphassl.com/gs/gsalphasha2g2.crl0#" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Heuristic match: "HEAD /edgedl/release2/Hcq1Yqsih2A/57.0.2987.133_56.0.2924.87_chrome_updater.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityUser-Agent: Microsoft BITS/7.5X-Old-UID: cnt=0X-Last-HR: 0x80042194X-Last-HTTP-Status-Code: 404" Heuristic match: "*big.Int" Heuristic match: "reflect.(*rtype).Name" Heuristic match: "reflect.(*rtype).In" Heuristic match: "reflect.Value.Int" Heuristic match: "reflect.(*funcType).Name" Heuristic match: "reflect.(*funcType).In" Heuristic match: "reflect.(*interfaceType).Name" Heuristic match: "reflect.(*interfaceType).In" Heuristic match: "reflect.(*structType).Name" Heuristic match: "reflect.(*structType).In" Heuristic match: "reflect.(*funcTypeFixed4).Name" Heuristic match: "reflect.(*funcTypeFixed4).In" Heuristic match: "reflect.(*funcTypeFixed8).Name" Heuristic match: "reflect.(*funcTypeFixed8).In" Heuristic match: "reflect.(*funcTypeFixed16).Name" Heuristic match: "reflect.(*funcTypeFixed16).In" Heuristic match: "reflect.(*funcTypeFixed32).Name" Heuristic match: "reflect.(*funcTypeFixed32).In" Heuristic match: "reflect.(*funcTypeFixed64).Name" Heuristic match: "reflect.(*funcTypeFixed64).In" Heuristic match: "reflect.(*funcTypeFixed128).Name" Heuristic match: "reflect.(*funcTypeFixed128).In" Heuristic match: "reflect.(*sliceType).Name" Heuristic match: "reflect.(*sliceType).In" Heuristic match: "unicode.to" Heuristic match: "unicode.To" Pattern match: "type..hash.math/rand.Rand" Pattern match: "type..eq.math/rand.Rand" Pattern match: "type..hash.math/rand.lockedSource" Pattern match: "type..eq.math/rand.lockedSource" Pattern match: "type..hash.net/url.Error" Pattern match: "type..eq.net/url.Error" Pattern match: "type..hash.net/url.Userinfo" Pattern match: "type..eq.net/url.Userinfo" Pattern match: "type..hash.net/url.URL" Pattern match: "type..eq.net/url.URL" Pattern match: "type..hash.net/http/httptrace.GotConnInfo" Pattern match: "type..eq.net/http/httptrace.GotConnInfo" Heuristic match: "net/http.(*Client).Do" Pattern match: "type..hash.net/http.httpError" Pattern match: "type..eq.net/http.httpError" Pattern match: "type..hash.net/http.http2FrameHeader" Pattern match: "type..eq.net/http.http2FrameHeader" Pattern match: "type..hash.net/http.http2resAndError" Pattern match: "type..eq.net/http.http2resAndError" Pattern match: "type..hash.net/http.http2PriorityParam" Pattern match: "type..eq.net/http.http2PriorityParam" Pattern match: "type..hash.net/http.connectMethod" Pattern match: "type..hash.net/http.http2StreamError" Pattern match: "type..hash.net/http.http2connError" Pattern match: "type..hash.net/http.http2WindowUpdateFrame" Pattern match: "type..eq.net/http.http2RSTStreamFrame" Pattern match: "type..hash.net/http.http2httpError" Pattern match: "type..eq.net/http.http2httpError" Pattern match: "type..hash.net/http.http2stickyErrWriter" Pattern match: "type..eq.net/http.http2stickyErrWriter" Pattern match: "type..hash.net/http.http2badStringError" Pattern match: "type..eq.net/http.http2badStringError" Pattern match: "type..hash.net/http.http2GoAwayError" Pattern match: "type..eq.net/http.http2gzipReader" Pattern match: "type..hash.net/http.badStringError" Pattern match: "github.com/kardianos/osext.init" Pattern match: "github.com/kr/fs.(*fs).ReadDir" Pattern match: "github.com/kr/fs.(*fs).Lstat" Pattern match: "github.com/kr/fs.(*fs).Join" Pattern match: "github.com/kr/fs.Walk" Pattern match: "github.com/kr/fs.WalkFS" Pattern match: "github.com/kr/fs.(*Walker).Step" Pattern match: "github.com/kr/fs.(*Walker).Err" Pattern match: "github.com/kr/fs.init" Pattern match: "type..hash.github.com/kr/fs.item" Pattern match: "type..eq.github.com/kr/fs.item" Pattern match: "github.com/kr/fs.item" Pattern match: "golang.org/x/sys/windows.(*DLLError).Error" Pattern match: "golang.org/x/sys/windows.LoadDLL" Pattern match: "golang.org/x/sys/windows.(*DLL).FindProc" Pattern match: "golang.org/x/sys/windows.(*LazyDLL).Load" Pattern match: "golang.org/x/sys/windows.(*LazyDLL).NewProc" Pattern match: "golang.org/x/sys/windows.NewLazySystemDLL" Pattern match: "golang.org/x/sys/windows.(*LazyProc).Find" Pattern match: "golang.org/x/sys/windows.(*LazyProc).mustFind" Pattern match: "golang.org/x/sys/windows.(*LazyProc).Addr" Pattern match: "golang.org/x/sys/windows.initCanDoSearchSystem32" Pattern match: "golang.org/x/sys/windows.canDoSearchSystem32" Pattern match: "golang.org/x/sys/windows.isBaseName" Pattern match: "golang.org/x/sys/windows.loadLibraryEx" Pattern match: "golang.org/x/sys/windows.errString.Error" Pattern match: "golang.org/x/sys/windows.Getenv" Pattern match: "golang.org/x/sys/windows.CloseOnExec" Pattern match: "golang.org/x/sys/windows.ByteSliceFromString" Pattern match: "golang.org/x/sys/windows.BytePtrFromString" Pattern match: "golang.org/x/sys/windows.UTF16FromString" Pattern match: "golang.org/x/sys/windows.UTF16PtrFromString" Pattern match: "golang.org/x/sys/windows.getStdHandle" Pattern match: "golang.org/x/sys/windows.LoadLibraryEx" Pattern match: "golang.org/x/sys/windows._LoadLibraryEx" Pattern match: "golang.org/x/sys/windows.GetStdHandle" Pattern match: "golang.org/x/sys/windows.SetHandleInformation" Pattern match: "golang.org/x/sys/windows.init" Pattern match: "golang.org/x/sys/windows.(*errString).Error" Pattern match: "type..hash.golang.org/x/sys/windows.DLLError" Pattern match: "type..eq.golang.org/x/sys/windows.DLLError" Pattern match: "type..hash.golang.org/x/sys/windows.DLL" Pattern match: "type..eq.golang.org/x/sys/windows.DLL" Pattern match: "type..hash.golang.org/x/sys/windows.Proc" Pattern match: "type..eq.golang.org/x/sys/windows.Proc" Pattern match: "type..hash.golang.org/x/sys/windows.LazyDLL" Pattern match: "type..eq.golang.org/x/sys/windows.LazyDLL" Pattern match: "type..hash.golang.org/x/sys/windows.LazyProc" Pattern match: "type..eq.golang.org/x/sys/windows.LazyProc" Pattern match: "golang.org/x/sys/windows.v" Pattern match: "golang.org/x/sys/windows.getprocaddress" Pattern match: "golang.org/x/sys/windows.loadlibrary" Pattern match: "golang.org/x/sys/windows/registry.Key.Close" Pattern match: "golang.org/x/sys/windows/registry.CreateKey" Pattern match: "golang.org/x/sys/windows/registry.Key.setValue" Pattern match: "golang.org/x/sys/windows/registry.Key.setStringValue" Pattern match: "golang.org/x/sys/windows/registry.Key.SetStringValue" Pattern match: "golang.org/x/sys/windows/registry.regCreateKeyEx" Pattern match: "golang.org/x/sys/windows/registry.regSetValueEx" Pattern match: "golang.org/x/sys/windows/registry.init" Pattern match: "golang.org/x/sys/windows/registry.(*Key).Close" Pattern match: "golang.org/x/sys/windows/registry/zsyscall_windows.go" Pattern match: "golang.org/x/sys/windows/registry/value.go" Pattern match: "golang.org/x/sys/windows/registry/key.go" Pattern match: "golang.org/x/sys/windows/asm_windows_386.s" Pattern match: "golang.org/x/sys/windows/ztypes_windows_386.go" Pattern match: "golang.org/x/sys/windows/zsyscall_windows.go" Pattern match: "golang.org/x/sys/windows/syscall_windows.go" Pattern match: "golang.org/x/sys/windows/syscall.go" Pattern match: "golang.org/x/sys/windows/exec_windows.go" Pattern match: "golang.org/x/sys/windows/env_windows.go" Pattern match: "golang.org/x/sys/windows/dll_windows.go" Pattern match: "github.com/kr/fs/walk.go" Pattern match: "github.com/kr/fs/filesystem.go" Pattern match: "github.com/kardianos/osext/osext_windows.go" Pattern match: "github.com/kardianos/osext/osext.go" Pattern match: "github.com/kardianos/osext.ce" Pattern match: "github.com/kardianos/osext.cx" Pattern match: "go.itab.io/ioutil.nopCloser,io.ReadCloser" Pattern match: "go.itab.io/ioutil.devNull,io.Writer" Pattern match: "go.itab.net/http.http2noDialClientConnPool,net/http.http2ClientConnPool" Pattern match: "go.itab.net/http.http2noDialH2RoundTripper,net/http.RoundTripper" Pattern match: "go.itab.net/http.http2ConnectionError,error" Pattern match: "go.itab.net/http.http2connError,error" Pattern match: "go.itab.net/http.http2StreamError,error" Pattern match: "go.itab.net/http.http2duplicatePseudoHeaderError,error" Pattern match: "go.itab.net/http.http2pseudoHeaderError,error" Pattern match: "go.itab.net/http.http2stickyErrWriter,io.Writer" Pattern match: "go.itab.net/http.http2GoAwayError,error" Pattern match: "go.itab.net/http.http2transportResponseBody,io.ReadCloser" Pattern match: "go.itab.net/http.stringWriter,net/http.writeStringer" Pattern match: "go.itab.net/http.noBody,io.ReadCloser" Pattern match: "go.itab.net/http.errorReader,io.Reader" Pattern match: "go.itab.net/http.finishAsyncByteRead,io.Reader" Pattern match: "go.itab.net/http.bodyLocked,io.Reader" Pattern match: "go.itab.net/http.persistConnWriter,io.Writer" Pattern match: "go.itab.net/http.nothingWrittenError,error" Pattern match: "go.itab.net/http.transportReadFromServerError,error" Pattern match: "go.itab.net/http.http2erringRoundTripper,net/http.RoundTripper" Pattern match: "go.itab.net/http.http2headerFieldNameError,error" Pattern match: "go.itab.net/http.http2headerFieldValueError,error" Pattern match: "go.itab.net/http.tlsHandshakeTimeoutError,error" Pattern match: "go.itab.net/http.fakeLocker,sync.Locker" Pattern match: "github.com/kardianos/osext.statictmp_10" Pattern match: "github.com/kardianos/osext.getModuleFileNameProc" Pattern match: "github.com/kardianos/osext.kernel" Pattern match: "github.com/kr/fs.fs,github.com/kr/fs.FileSystem" Pattern match: "golang.org/x/sys/windows/registry.procRegLoadMUIStringW" Pattern match: "golang.org/x/sys/windows/registry.ErrUnexpectedType" Pattern match: "golang.org/x/sys/windows/registry.procRegCreateKeyExW" Pattern match: "golang.org/x/sys/windows/registry.procRegDeleteKeyW" Pattern match: "golang.org/x/sys/windows/registry.procRegSetValueExW" Pattern match: "golang.org/x/sys/windows/registry.procRegEnumValueW" Pattern match: "golang.org/x/sys/windows/registry.procRegDeleteValueW" Pattern match: "golang.org/x/sys/windows/registry.procExpandEnvironmentStringsW" Pattern match: "golang.org/x/sys/windows/registry.modadvapi32" Pattern match: "golang.org/x/sys/windows/registry.modkernel32" Pattern match: "go.itab.net/url.EscapeError,error" Pattern match: "go.itab.net/url.InvalidHostError,error" Pattern match: "go.itab.net/textproto.ProtocolError,error" Heuristic match: "unicode.Cc" Heuristic match: "unicode.Cf" Heuristic match: "unicode.Co" Heuristic match: "unicode.Lt" Heuristic match: "unicode.Lu" Heuristic match: "unicode.Mc" Heuristic match: "unicode.Me" Heuristic match: "unicode.Mn" Heuristic match: "unicode.Nl" Heuristic match: "unicode.No" Heuristic match: "unicode.Pe" Heuristic match: "unicode.Pf" Heuristic match: "unicode.Ps" Heuristic match: "unicode.Sc" Heuristic match: "unicode.Sk" Heuristic match: "unicode.Sm" Heuristic match: "unicode.So" Pattern match: "golang.org/x/sys/windows.DLLError,error" Pattern match: "golang.org/x/sys/windows.statictmp_20" Pattern match: "golang.org/x/sys/windows.modkernel32" Pattern match: "golang.org/x/sys/windows.canDoSearchSystem32Once" Pattern match: "go.itab.golang.org/x/sys/windows.errString,error" Pattern match: "golang.org/x/sys/windows.procCancelIoEx" Pattern match: "golang.org/x/sys/windows.procSetFileCompletionNotificationModes" Pattern match: "golang.org/x/sys/windows.procGetAddrInfoW" Pattern match: "golang.org/x/sys/windows.procCreateSymbolicLinkW" Pattern match: "golang.org/x/sys/windows.procRegisterEventSourceW" Pattern match: "golang.org/x/sys/windows.procDeregisterEventSource" Pattern match: "golang.org/x/sys/windows.procReportEventW" Pattern match: "golang.org/x/sys/windows.procOpenSCManagerW" Pattern match: "golang.org/x/sys/windows.procCloseServiceHandle" Pattern match: "golang.org/x/sys/windows.procCreateServiceW" Pattern match: "golang.org/x/sys/windows.procOpenServiceW" Pattern match: "golang.org/x/sys/windows.procDeleteService" Pattern match: "golang.org/x/sys/windows.procStartServiceW" Pattern match: "golang.org/x/sys/windows.procQueryServiceStatus" Pattern match: "golang.org/x/sys/windows.procControlService" Pattern match: "golang.org/x/sys/windows.procStartServiceCtrlDispatcherW" Pattern match: "golang.org/x/sys/windows.procSetServiceStatus" Pattern match: "golang.org/x/sys/windows.procChangeServiceConfigW" Pattern match: "golang.org/x/sys/windows.procQueryServiceConfigW" Pattern match: "golang.org/x/sys/windows.procChangeServiceConfig2W" Pattern match: "golang.org/x/sys/windows.procQueryServiceConfig2W" Pattern match: "golang.org/x/sys/windows.procGetLastError" Pattern match: "golang.org/x/sys/windows.procLoadLibraryW" Pattern match: "golang.org/x/sys/windows.procLoadLibraryExW" Pattern match: "golang.org/x/sys/windows.procFreeLibrary" Pattern match: "golang.org/x/sys/windows.procGetProcAddress" Pattern match: "golang.org/x/sys/windows.procGetVersion" Pattern match: "golang.org/x/sys/windows.procFormatMessageW" Pattern match: "golang.org/x/sys/windows.procExitProcess" Pattern match: "golang.org/x/sys/windows.procCreateFileW" Pattern match: "lang.org/x/sys/windows.procGetStdHandle" Pattern match: "lang.org/x/sys/windows.procFindFirstFileW" Pattern match: "g.org/x/sys/windows.procGetCurrentProcessId" Pattern match: "golang.org/x/sys/windows.procGetConsoleMode" Pattern match: "golang.org/x/sys/windows.procWriteConsoleW" Pattern match: "golang.org/x/sys/windows.procReadConsoleW" Pattern match: "golang.org/x/sys/windows.procCreateToolhelp32Snapshot" Pattern match: "golang.org/x/sys/windows.procProcess32FirstW" Pattern match: "golang.org/x/sys/windows.procProcess32NextW" Pattern match: "golang.org/x/sys/windows.procDeviceIoControl" Pattern match: "golang.org/x/sys/windows.procCreateHardLinkW" Pattern match: "golang.org/x/sys/windows.procGetCurrentThreadId" Pattern match: "golang.org/x/sys/windows.procCreateEventW" Pattern match: "golang.org/x/sys/windows.procSetEvent" Pattern match: "golang.org/x/sys/windows.procWSAStartup" Pattern match: "golang.org/x/sys/windows.procWSACleanup" Pattern match: "golang.org/x/sys/windows.procWSAIoctl" Pattern match: "golang.org/x/sys/windows.procsocket" Pattern match: "golang.org/x/sys/windows.procsetsockopt" Pattern match: "golang.org/x/sys/windows.procgetsockopt" Pattern match: "golang.org/x/sys/windows.procbind" Pattern match: "golang.org/x/sys/windows.procconnect" Pattern match: "golang.org/x/sys/windows.procgetsockname" Pattern match: "golang.org/x/sys/windows.procgetpeername" Pattern match: "golang.org/x/sys/windows.proclisten" Pattern match: "golang.org/x/sys/windows.procshutdown" Pattern match: "golang.org/x/sys/windows.procclosesocket" Pattern match: "golang.org/x/sys/windows.procAcceptEx" Pattern match: "golang.org/x/sys/windows.procGetAcceptExSockaddrs" Pattern match: "golang.org/x/sys/windows.procWSARecv" Pattern match: "golang.org/x/sys/windows.procWSASend" Pattern match: "golang.org/x/sys/windows.procWSARecvFrom" Pattern match: "golang.org/x/sys/windows.procWSASendTo" Pattern match: "golang.org/x/sys/windows.procgethostbyname" Pattern match: "golang.org/x/sys/windows.procgetservbyname" Pattern match: "golang.org/x/sys/windows.procntohs" Pattern match: "golang.org/x/sys/windows.procgetprotobyname" Pattern match: "golang.org/x/sys/windows.procDnsQuery_W" Pattern match: "golang.org/x/sys/windows.procDnsRecordListFree" Pattern match: "golang.org/x/sys/windows.procDnsNameCompare_W" Pattern match: "golang.org/x/sys/windows.procFreeAddrInfoW" Pattern match: "golang.org/x/sys/windows.procGetIfEntry" Pattern match: "golang.org/x/sys/windows.procGetAdaptersInfo" Pattern match: "golang.org/x/sys/windows.procWSAEnumProtocolsW" Pattern match: "golang.org/x/sys/windows.procGetAdaptersAddresses" Pattern match: "golang.org/x/sys/windows.procGetACP" Pattern match: "golang.org/x/sys/windows.procMultiByteToWideChar" Pattern match: "golang.org/x/sys/windows.procTranslateNameW" Pattern match: "golang.org/x/sys/windows.procGetUserNameExW" Pattern match: "golang.org/x/sys/windows.procNetUserGetInfo" Pattern match: "golang.org/x/sys/windows.procNetGetJoinInformation" Pattern match: "golang.org/x/sys/windows.procNetApiBufferFree" Pattern match: "golang.org/x/sys/windows.procLookupAccountSidW" Pattern match: "golang.org/x/sys/windows.procLookupAccountNameW" Pattern match: "golang.org/x/sys/windows.procConvertSidToStringSidW" Pattern match: "golang.org/x/sys/windows.procConvertStringSidToSidW" Pattern match: "golang.org/x/sys/windows.procGetLengthSid" Pattern match: "golang.org/x/sys/windows.procCopySid" Pattern match: "golang.org/x/sys/windows.procAllocateAndInitializeSid" Pattern match: "golang.org/x/sys/windows.procFreeSid" Pattern match: "golang.org/x/sys/windows.procEqualSid" Pattern match: "golang.org/x/sys/windows.procOpenProcessToken" Pattern match: "golang.org/x/sys/windows.procGetTokenInformation" Pattern match: "golang.org/x/sys/windows.procGetUserProfileDirectoryW" Pattern match: "golang.org/x/sys/windows.Stdin" Pattern match: "golang.org/x/sys/windows.Stdout" Pattern match: "golang.org/x/sys/windows.Stderr" Pattern match: "golang.org/x/sys/windows.modadvapi32" Pattern match: "golang.org/x/sys/windows.modshell32" Pattern match: "golang.org/x/sys/windows.modmswsock" Pattern match: "golang.org/x/sys/windows.modcrypt32" Pattern match: "golang.org/x/sys/windows.modws2_32" Pattern match: "golang.org/x/sys/windows.moddnsapi" Pattern match: "golang.org/x/sys/windows.modiphlpapi" Pattern match: "golang.org/x/sys/windows.modsecur32" Pattern match: "golang.org/x/sys/windows.modnetapi32" Pattern match: "golang.org/x/sys/windows.moduserenv" Pattern match: "golang.org/x/sys/windows.loadlibrary.args_stackmap" Pattern match: "golang.org/x/sys/windows.getprocaddress.args_stackmap" Heuristic match: "runtime.name" Heuristic match: "*math/big.Int" Heuristic match: "math/big.Int" Heuristic match: "crypto/x509/pkix.Name" Pattern match: "golang.org/x/sys/windows.LazyProc" Pattern match: "golang.org/x/sys/windows.LazyDLL" Pattern match: "golang.org/x/sys/windows.DLL" Pattern match: "golang.org/x/sys/windows.Handle" Pattern match: "golang.org/x/sys/windows.Proc" Heuristic match: "reflect.name" Heuristic match: "*crypto/x509/pkix.Name" Heuristic match: "**math/big.Int" Pattern match: "github.com/kr/fs.fs" Pattern match: "github.com/kr/fs.Walker" Pattern match: "github.com/kr/fs.FileSystem" Pattern match: "golang.org/x/sys/windows.DLLError" Pattern match: "golang.org/x/sys/windows.errString" Pattern match: "golang.org/x/sys/windows/registry.Key" Heuristic match: "m.name" Heuristic match: "reflect.(*ptrType).Name" Heuristic match: "reflect.(*ptrType).In" Pattern match: "type..hash.net/http/internal.chunkedReader" Pattern match: "type..eq.net/http/internal.chunkedReader" Heuristic match: "wr.ch" Pattern match: "type..hash.net/http.http2Setting" Pattern match: "type..eq.net/http.http2Setting" Pattern match: "type..hash.net/http.connectMethodKey" Pattern match: "type..eq.net/http.connectMethodKey" Pattern match: "type..hash.net/http.responseAndError" Pattern match: "type..eq.net/http.responseAndError" Pattern match: "type..hash.net/http.requestAndChan" Pattern match: "type..eq.net/http.requestAndChan" Pattern match: "type..eq.net/http.connectMethod" Pattern match: "type..hash.net/http.http2dialCall" Pattern match: "type..eq.net/http.http2dialCall" Pattern match: "type..hash.net/http.http2addConnCall" Pattern match: "type..eq.net/http.http2addConnCall" Pattern match: "type..eq.net/http.http2StreamError" Pattern match: "type..eq.net/http.http2connError" Pattern match: "type..eq.net/http.badStringError" Pattern match: "type..hash.net/http.readResult" Pattern match: "type..eq.net/http.readResult" Pattern match: "type..hash.net/http.gzipReader" Pattern match: "type..eq.net/http.gzipReader" Pattern match: "github.com/kardianos/osext.executableClean" Pattern match: "github.com/kardianos/osext.executable" Pattern match: "github.com/kardianos/osext.getModuleFileName" Pattern match: "golang.org/x/sys/windows.procReadFile" Pattern match: "golang.org/x/sys/windows.procWriteFile" Pattern match: "golang.org/x/sys/windows.procSetFilePointer" Pattern match: "golang.org/x/sys/windows.procCloseHandle" Pattern match: "golang.org/x/sys/windows.procGetStdHandle" Pattern match: "golang.org/x/sys/windows.procFindFirstFileW" Pattern match: "golang.org/x/sys/windows.procFindNextFileW" Pattern match: "golang.org/x/sys/windows.procFindClose" Pattern match: "golang.org/x/sys/windows.procGetFileInformationByHandle" Pattern match: "golang.org/x/sys/windows.procGetCurrentDirectoryW" Pattern match: "golang.org/x/sys/windows.procSetCurrentDirectoryW" Pattern match: "golang.org/x/sys/windows.procCreateDirectoryW" Pattern match: "golang.org/x/sys/windows.procRemoveDirectoryW" Pattern match: "golang.org/x/sys/windows.procDeleteFileW" Pattern match: "golang.org/x/sys/windows.procMoveFileW" Pattern match: "golang.org/x/sys/windows.procMoveFileExW" Pattern match: "golang.org/x/sys/windows.procGetComputerNameW" Pattern match: "golang.org/x/sys/windows.procGetComputerNameExW" Pattern match: "golang.org/x/sys/windows.procSetEndOfFile" Pattern match: "golang.org/x/sys/windows.procGetSystemTimeAsFileTime" Pattern match: "golang.org/x/sys/windows.procGetTimeZoneInformation" Pattern match: "golang.org/x/sys/windows.procCreateIoCompletionPort" Pattern match: "golang.org/x/sys/windows.procGetQueuedCompletionStatus" Pattern match: "golang.org/x/sys/windows.procPostQueuedCompletionStatus" Pattern match: "golang.org/x/sys/windows.procCancelIo" Pattern match: "golang.org/x/sys/windows.procCreateProcessW" Pattern match: "golang.org/x/sys/windows.procOpenProcess" Pattern match: "golang.org/x/sys/windows.procTerminateProcess" Pattern match: "golang.org/x/sys/windows.procGetExitCodeProcess" Pattern match: "golang.org/x/sys/windows.procGetStartupInfoW" Pattern match: "golang.org/x/sys/windows.procGetCurrentProcess" Pattern match: "golang.org/x/sys/windows.procGetProcessTimes" Pattern match: "golang.org/x/sys/windows.procDuplicateHandle" Pattern match: "golang.org/x/sys/windows.procWaitForSingleObject" Pattern match: "golang.org/x/sys/windows.procGetTempPathW" Pattern match: "golang.org/x/sys/windows.procCreatePipe" Pattern match: "golang.org/x/sys/windows.procGetFileType" Pattern match: "golang.org/x/sys/windows.procCryptAcquireContextW" Pattern match: "golang.org/x/sys/windows.procCryptReleaseContext" Pattern match: "golang.org/x/sys/windows.procCryptGenRandom" Pattern match: "golang.org/x/sys/windows.procGetEnvironmentStringsW" Pattern match: "golang.org/x/sys/windows.procFreeEnvironmentStringsW" Pattern match: "golang.org/x/sys/windows.procGetEnvironmentVariableW" Pattern match: "golang.org/x/sys/windows.procSetEnvironmentVariableW" Pattern match: "golang.org/x/sys/windows.procSetFileTime" Pattern match: "golang.org/x/sys/windows.procGetFileAttributesW" Pattern match: "golang.org/x/sys/windows.procSetFileAttributesW" Pattern match: "golang.org/x/sys/windows.procGetFileAttributesExW" Pattern match: "golang.org/x/sys/windows.procGetCommandLineW" Pattern match: "golang.org/x/sys/windows.procCommandLineToArgvW" Pattern match: "golang.org/x/sys/windows.procLocalFree" Pattern match: "golang.org/x/sys/windows.procSetHandleInformation" Pattern match: "golang.org/x/sys/windows.procFlushFileBuffers" Pattern match: "golang.org/x/sys/windows.procGetFullPathNameW" Pattern match: "golang.org/x/sys/windows.procGetLongPathNameW" Pattern match: "golang.org/x/sys/windows.procGetShortPathNameW" Pattern match: "golang.org/x/sys/windows.procCreateFileMappingW" Pattern match: "golang.org/x/sys/windows.procMapViewOfFile" Pattern match: "golang.org/x/sys/windows.procUnmapViewOfFile" Pattern match: "golang.org/x/sys/windows.procFlushViewOfFile" Pattern match: "golang.org/x/sys/windows.procVirtualLock" Pattern match: "golang.org/x/sys/windows.procVirtualUnlock" Pattern match: "golang.org/x/sys/windows.procTransmitFile" Pattern match: "golang.org/x/sys/windows.procReadDirectoryChangesW" Pattern match: "golang.org/x/sys/windows.procCertOpenSystemStoreW" Pattern match: "golang.org/x/sys/windows.procCertOpenStore" Pattern match: "golang.org/x/sys/windows.procCertEnumCertificatesInStore" Pattern match: "golang.org/x/sys/windows.procCertAddCertificateContextToStore" Pattern match: "golang.org/x/sys/windows.procCertCloseStore" Pattern match: "golang.org/x/sys/windows.procCertGetCertificateChain" Pattern match: "golang.org/x/sys/windows.procCertFreeCertificateChain" Pattern match: "golang.org/x/sys/windows.procCertCreateCertificateContext" Pattern match: "golang.org/x/sys/windows.procCertFreeCertificateContext" Pattern match: "golang.org/x/sys/windows.procCertVerifyCertificateChainPolicy" Pattern match: "golang.org/x/sys/windows.procRegOpenKeyExW" Pattern match: "golang.org/x/sys/windows.procRegCloseKey" Pattern match: "golang.org/x/sys/windows.procRegQueryInfoKeyW" Pattern match: "golang.org/x/sys/windows.procRegEnumKeyExW" Pattern match: "golang.org/x/sys/windows.procRegQueryValueExW" Pattern match: "golang.org/x/sys/windows.procGetCurrentProcessId" Pattern match: "type..hash.net/http.http2PingFrame" Pattern match: "type..eq.net/http.http2PingFrame" Pattern match: "type..eq.net/http.http2WindowUpdateFrame" Pattern match: "type..hash.net/http.http2PriorityFrame" Pattern match: "type..eq.net/http.http2PriorityFrame" Pattern match: "type..hash.net/http.http2RSTStreamFrame" Pattern match: "type..eq.net/http.http2GoAwayError" Pattern match: "type..hash.net/http.http2gzipReader"28:T82d,"= helpgc= incr=%v is not mcount= minutes nalloc= newval= nfreed= packed= ping=%q pointer stack=[%!Month(%s|%s|%s, found , idle: 48828125; SecureAcceptExAcceptedArmenianBalineseBopomofoBugineseCancelIoCherokeeConflictContinueCyrillicDSA-SHA1DecemberDuployanDurationEqualSidEthiopicExtenderFebruaryFileModeGeorgianGujaratiGurmukhiHTTP/1.0HTTP/1.1HTTP/2.0HashFuncHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BLocationMahajaniNO_ERRORNO_PROXYNovemberNumFieldOl_ChikiPRIORITYPROPFINDParseIntPhags_PaPriorityRdlengthReadFileReadFromReceivedSETTINGSSHA1-RSASaturdaySetEventTagbanwaTai_ThamTai_VietThursdayTifinaghUgariticWSAIoctlZONEINFO[signal stack=[address cgocheckcore.execs default:eax ebp ebx ecx edi edx eflags eip ellipticesi esp explicitfs gs hijackedhttp/1.1httponlyidentityif-matchif-rangelocationloopbacknext_gc=no anodeno-cacheno_proxyoptionalreadfromreadlinkregistryrunnableruntime.scavengeshutdownssl30MACstrconv.tls10MACunixgramunknown(us-asciiwbshadowwsaioct" (Indicator: "icext") "= helpgc= incr=%v is not mcount= minutes nalloc= newval= nfreed= packed= ping=%q pointer stack=[%!Month(%s|%s|%s, found , idle: 48828125; SecureAcceptExAcceptedArmenianBalineseBopomofoBugineseCancelIoCherokeeConflictContinueCyrillicDSA-SHA1DecemberDuployanDurationEqualSidEthiopicExtenderFebruaryFileModeGeorgianGujaratiGurmukhiHTTP/1.0HTTP/1.1HTTP/2.0HashFuncHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BLocationMahajaniNO_ERRORNO_PROXYNovemberNumFieldOl_ChikiPRIORITYPROPFINDParseIntPhags_PaPriorityRdlengthReadFileReadFromReceivedSETTINGSSHA1-RSASaturdaySetEventTagbanwaTai_ThamTai_VietThursdayTifinaghUgariticWSAIoctlZONEINFO[signal stack=[address cgocheckcore.execs default:eax ebp ebx ecx edi edx eflags eip ellipticesi esp explicitfs gs hijackedhttp/1.1httponlyidentityif-matchif-rangelocationloopbacknext_gc=no anodeno-cacheno_proxyoptionalreadfromreadlinkregistryrunnableruntime.scavengeshutdownssl30MACstrconv.tls10MACunixgramunknown(us-asciiwbshadowwsaioc" (Indicator: "icext")29:T7cf,Found dropped filename "pspubws@bidswitch[1].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@uplift-platform[2].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@songspk[3].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@today[1].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.lowermybills[1].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@nexage[1].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@google[3].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@matrixspa[1].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@symantec[1].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@pardot[2].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@acer[1].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.repubblica[2].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@content.delta[9].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@hit.interia[3].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@rutube[2].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@tubemogul[2].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@yandex[1].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@wheretowatch[1].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@groupalia[1].txt.cypher" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@craigslist[1].txt.cypher" containing the Windows username "PSPUBWS"2a:T8e6,"433653942643c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f0011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650http2: Transport: peer server initiated graceful shutdown after some of Request.Body was written; define Request.GetBody to avoid this error68647976601306097149819007990813932172694353001433054093944634591855431833976560521225596406614545549772963113914808580371219879997166438125740282911150571516864797660130609714981900799081393217269435300143305409394463459185543183397655394245057746333217197532963996371363321113864768612440380340372808892707005449 Your files have been encrypted.

Your files have been encrypted.

To decrypt your files" (Source: 1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe.bin, Indicator: "decrypt your files") "433653942643c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f0011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650http2: Transport: peer server initiated graceful shutdown after some of Request.Body was written; define Request.GetBody to avoid this error68647976601306097149819007990813932172694353001433054093944634591855431833976560521225596406614545549772963113914808580371219879997166438125740282911150571516864797660130609714981900799081393217269435300143305409394463459185543183397655394245057746333217197532963996371363321113864768612440380340372808892707005449 Your files have been encrypted.

Your files have been encrypted.

To decrypt your file" (Source: 1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe.bin, Indicator: "files have been encrypted")2b:Tc2d,"C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\AdobeID.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\DefaultID.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\AdobeID.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\DefaultID.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\Dynamic.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\SignHere.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\StandardBusiness.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\Words.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Resource\ENUtxt.pdf" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\AutoIt3\AutoItX\Examples\C++\_readme.txt" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\AutoIt3\AutoItX\Examples\VBScript\_readme.txt" for deletion "C:\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe" marked "C:\Program Files\AutoIt3\Examples\COM\Worksheet.xls" for deletion2c:T897,"" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\AdobeID.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\DefaultID.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\AdobeID.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\DefaultID.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\Dynamic.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\SignHere.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\StandardBusiness.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\Words.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Resource\ENUtxt.pdf" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt" with delete access "" opened "C:\Program Files\Adobe\Reader 11.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt" with delete access "" opened "C:\Program Files\AutoIt3\AutoItX\Examples\C++\_readme.txt" with delete access "" opened "C:\Program Files\AutoIt3\AutoItX\Examples\VBScript\_readme.txt" with delete access "" opened "C:\Program Files\AutoIt3\Examples\COM\Worksheet.xls" with delete access2d:T901,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2e:T695,Found malicious artifacts related to "198.251.81.217": ... URL: http://gdcbghvjyqy7jclk.onion.casa/a6b2de5bc3774111 Pattern (AV positives: 4/67 scanned on 02/19/2018 13:00:16) URL: http://vvrhhhnaijyj6s2m.onion.casa/ (AV positives: 4/67 scanned on 02/18/2018 22:42:24) URL: http://yowl2ugopitfzzwb.onion.casa/ (AV positives: 1/67 scanned on 02/18/2018 22:16:19) URL: http://gdcbghvjyqy7jclk.onion.casa/f4a907f7c371cdb8 Pattern (AV positives: 4/67 scanned on 02/17/2018 17:20:48) URL: http://gdcbghvjyqy7jclk.onion.casa/84f02e6e5cb380f6 Pattern (AV positives: 4/67 scanned on 02/15/2018 22:13:27) File SHA256: 1038f53799c1c96ba1026ddcff8c087ea85bdc88b7bc700771b8c8afc1d8ffa7 (AV positives: 5/66 scanned on 02/19/2018 13:32:13) File SHA256: 4d43bebd52bbcbbac13476e3147069a2da66a8b033bf8ba9fd224e73566a95d2 (AV positives: 14/66 scanned on 02/19/2018 08:27:26) File SHA256: d73e0e12620881019b8256a9622d389d485906ab84254b2fdfc82349a308831e (AV positives: 13/67 scanned on 02/17/2018 21:58:05) File SHA256: 98ab8e0391472674371499870e8da0797f37991e1b6b98fd495b34aaee2cb90e (AV positives: 8/67 scanned on 02/16/2018 10:54:51) File SHA256: 625b125f1ef508b1b6b4adbd57e5f71913eab3392f6e13fe9c1025ecf01843e4 (AV positives: 4/68 scanned on 02/16/2018 01:55:32) File SHA256: 6bab49584667ad1be20ee02775a54e59339587cd10afa4b3934da09ce4322e23 (Date: 12/13/2017 06:58:51) File SHA256: 12f31200177966d1a9265e3dd57fafa9b68aa975d08e0abc5bdd4091263ffb73 (Date: 12/13/2017 06:57:32) File SHA256: e2bc2b4953b7d602427733d5bbd03a86d95091be6d62b1fbc71122e2bfa0e667 (Date: 12/06/2017 20:37:40) File SHA256: a1d2836c6d2001758ec581ad83cf4399e285d7e7b201c3f254da1765eef70332 (Date: 11/28/2017 15:38:22)2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790506197623,"unified_at":"2026-09-27T10:49:57.623Z","metadata":{"hashes":{"sha256":"1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5","sha1":"f9b20698d3d04fb0e8e187f04ac1166bb6fc4728","md5":"54f362fd6ccb4763a96f0f0cd4bc7da9","sha512":"0e04a720e420da2e7e737d5f6eb3085c3ba049ee1c6dfa6825a4a492923ef349c0c3eb8e0229005b4c098369e1308df3766e82edc0233a6146be5c2442d47572","ssdeep":"49152:01DS0n3A6wyZYr7r1OOrvESDnz4mH2puWmxWTjjpoiIgg3V5xYNvRdA:6n3A6w0oROOr/z4Xjjpo","ssdeep_chunks":["49152:01DS0n3","49152:1DS0n3A","49152:DS0n3A6","49152:S0n3A6w","49152:0n3A6wy","49152:n3A6wyZ","49152:3A6wyZY","49152:A6wyZYr","49152:6wyZYr7","49152:wyZYr7r","49152:yZYr7r1","49152:ZYr7r1O","49152:Yr7r1OO","49152:r7r1OOr","49152:7r1OOrv","49152:r1OOrvE","49152:1OOrvES","49152:OOrvESD","49152:OrvESDn","49152:rvESDnz","49152:vESDnz4","49152:ESDnz4m","49152:SDnz4mH","49152:Dnz4mH2","49152:nz4mH2p","49152:z4mH2pu","49152:4mH2puW","49152:mH2puWm","49152:H2puWmx","49152:2puWmxW","49152:puWmxWT","49152:uWmxWTj","49152:WmxWTjj","49152:mxWTjjp","49152:xWTjjpo","49152:WTjjpoi","49152:TjjpoiI","49152:jjpoiIg","49152:jpoiIgg","49152:poiIgg3","49152:oiIgg3V","49152:iIgg3V5","49152:Igg3V5x","49152:gg3V5xY","49152:g3V5xYN","49152:3V5xYNv","49152:V5xYNvR","49152:5xYNvRd","49152:xYNvRdA","98304:01DS0n3","98304:1DS0n3A","98304:DS0n3A6","98304:S0n3A6w","98304:0n3A6wy","98304:n3A6wyZ","98304:3A6wyZY","98304:A6wyZYr","98304:6wyZYr7","98304:wyZYr7r","98304:yZYr7r1","98304:ZYr7r1O","98304:Yr7r1OO","98304:r7r1OOr","98304:7r1OOrv","98304:r1OOrvE","98304:1OOrvES","98304:OOrvESD","98304:OrvESDn","98304:rvESDnz","98304:vESDnz4","98304:ESDnz4m","98304:SDnz4mH","98304:Dnz4mH2","98304:nz4mH2p","98304:z4mH2pu","98304:4mH2puW","98304:mH2puWm","98304:H2puWmx","98304:2puWmxW","98304:puWmxWT","98304:uWmxWTj","98304:WmxWTjj","98304:mxWTjjp","98304:xWTjjpo","98304:WTjjpoi","98304:TjjpoiI","98304:jjpoiIg","98304:jpoiIgg","98304:poiIgg3","98304:oiIgg3V","98304:iIgg3V5","98304:Igg3V5x","98304:gg3V5xY","98304:g3V5xYN","98304:3V5xYNv","98304:V5xYNvR","98304:5xYNvRd","98304:xYNvRdA","49152:6n3A6w0","49152:n3A6w0o","49152:3A6w0oR","49152:A6w0oRO","49152:6w0oROO","49152:w0oROOr","49152:0oROOr/","49152:oROOr/z","49152:ROOr/z4","49152:OOr/z4X","49152:Or/z4Xj","49152:r/z4Xjj","49152:/z4Xjjp","49152:z4Xjjpo"],"imphash":"f4cc01c5888458a51fcb49aa4355a29d"},"file_info":{"file_name":"vL7m34qWISaBkgLe1hhOVRMUGLvNUlTayOK.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4586496,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1519047509000,"last_seen":1678037530000,"last_multi_scan":1678037530000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":15,"malicious_count":6,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Blocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Gojdu.kaotz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.BXZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.BXZ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.NPW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Filecoder.al","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Blocker.krjb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Blocker.eyccnx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Gojdue-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Blocker.4586496","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.53E2C665","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.53E2C665","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.BKKZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Blocker.Win32.39653","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.53E2C665","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$24","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"u4hp32ms2u6s4x7q.onion.casa\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"198.251.81.217:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"ReadMe.txt.cypher\" has type \"data\"\n \"HPFeb15_arrow_left[1].png.cypher\" has type \"data\"\n \"pspubws@bidswitch[1].txt.cypher\" has type \"data\"\n \"TableTextServiceDaYi.txt.cypher\" has type \"data\"\n \"readme.txt.cypher\" has type \"data\"\n \"flower_settings.png.cypher\" has type \"data\"\n \"pspubws@uplift-platform[2].txt.cypher\" has type \"data\"\n \"docked_gray_hail.png.cypher\" has type \"data\"\n \"pspubws@songspk[3].txt.cypher\" has type \"data\"\n \"Pets_image-frame-backglow.png.cypher\" has type \"data\"\n \"AA3e3XC[1].png.cypher\" has type \"data\"\n \"InlineObjects.png.cypher\" has type \"data\"\n \"BBmUxRK[1].png.cypher\" has type \"data\"\n \"activity16v.png.cypher\" has type \"data\"\n \"shadowonlyframe_selectionsubpicture.png.cypher\" has type \"data\"\n \"CA-wp5.jpg.cypher\" has type \"SysEx File - Kurzweil/Future Retro Channel 141\"\n \"BBjBl9m[1].png.cypher\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\WSHTCPIP.DLL\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\wshtcpip.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\wship6.dll\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\wship6.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\wshqos.dll\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\wshqos.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\crypt32.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00014591-00003732-00000105-40870313","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$28","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"$29","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"CORE.EXE\"; Value: \"%APPDATA%\\core354535345.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \">1.3.6.1.5.5.7.3.1\"\n Heuristic match: \"1.3.6.1.4.1.311.10.3.3\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2a","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2b","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2c","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2d","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n LoadLibraryA\n GetProcAddress\n GetThreadContext\n CreateThread\n WriteFile\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY DNS Query to .onion proxy Domain (onion .casa in DNS Lookup)\" (SID: 2025096, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\"\n Detected alert \"ETPRO POLICY DNS Query to .onion proxy Domain (onion . casa)\" (SID: 2825120, Rev: 2, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/67 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/67 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_ReadMe_.txt.cypher\" which has been seen in the context of ransomware (Indicator: README_.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"\" touched \"K:\\\"\n \"\" touched \"L:\\\"\n \"\" touched \"M:\\\"\n \"\" touched \"N:\\\"\n \"\" touched \"O:\\\"\n \"\" touched \"P:\\\"\n \"\" touched \"Q:\\\"\n \"\" touched \"R:\\\"\n \"\" touched \"S:\\\"\n \"\" touched \"T:\\\"\n \"\" touched \"U:\\\"\n \"\" touched \"V:\\\"\n \"\" touched \"W:\\\"\n \"\" touched \"X:\\\"\n \"\" touched \"Y:\\\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":38,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":112,"files_deleted_count":0,"registry_keys_created_count":49,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":49,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"5a8ad0a97ca3e1755e5eff53","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gojdu.A","contacted_countries":["USA"],"submit_name":"vL7m34qWISaBkgLe1hhOVRMUGLvNUlTayOK.exe","analysis_start_time":"2018-02-19T14:27:52+00:00","indicators_count":{"informative":10,"suspicious":17,"malicious":7},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"198.251.81.217","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]}],"dns_resolutions":[{"domain":"u4hp32ms2u6s4x7q.onion.casa","ttl":21599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}],"processes":[{"pid":3732,"ppid":0,"name":"1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe","command_line":"","sha256":"1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5","normalized_path":"C:\\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe","uid":"00014591-00003732","icon":"$2f"}],"all_imported_dlls":["wship6.dll","rsaenh.dll","bcrypt.dll","sechost.dll","rasadhlp.dll","crypt32.dll","ncrypt.dll","ntdll.dll","winmm.dll","msctf.dll","advapi32.dll","mswsock.dll","msasn1.dll","kernel32.dll","user32.dll","winnsi.dll","gpapi.dll","gdi32.dll","imm32.dll","WSHTCPIP.DLL","dnsapi.dll","cryptsp.dll","KernelBase.dll","shell32.dll","shlwapi.dll","FWPUCLNT.DLL","userenv.dll","msvcrt.dll","usp10.dll","nsi.dll","lpk.dll","ws2_32.dll","rpcrt4.dll","cryptbase.dll","wshqos.dll","IPHLPAPI.DLL","profapi.dll","bcryptprimitives.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"encryption_key","sha256":"ff800f745a498fb424bfa3554ae5278acef94354111783b818498fbc9fb408e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"AdobeID.pdf.cypher","sha256":"2f9c7066fd28df0a6bcaa9712785676959081618e1120acbd204d35a6c265980","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"DefaultID.pdf.cypher","sha256":"1481f106e1651c67b5b82ed83a2f96b57fda91c2a9bd323b12e9846db8ebe804","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"PDFSigQFormalRep.pdf.cypher","sha256":"6bfd3d874eee4d1af7c92a47fb1d38ee7851dec02c1c02832dac2d4048cc9beb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"Dynamic.pdf.cypher","sha256":"b5f89829436a0909dae6a6f3feb713baa1200c8628f660f72425c77228ce7daa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"SignHere.pdf.cypher","sha256":"eb4a804174789e8252688274a10d37a0d4b95df3ecb61677aa24faff173055bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"StandardBusiness.pdf.cypher","sha256":"7fa84e422cc27c00845d266c9606565f917f72bce604b95abe112c3faad0173e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"Words.pdf.cypher","sha256":"dae9beddab716c8d6bd935eefc0d51ad6dfac6e2ef1c3ea9b02486b84ed733f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"ENUtxt.pdf.cypher","sha256":"b38b3f0900d78616dc50af49055c0c1d29558161bb0fb9a01dbae75f9a27c7ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"zdingbat.txt.cypher","sha256":"7802da5ef998cf0b0c28930ff597fd6971482396391c2ff9f6dd4f6c206e5c26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"_readme.txt.cypher","sha256":"657bad5c9a6df84d4a19e73008c655081c84af321d0c565ac404c64ea7ff0f44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"Worksheet.xls.cypher","sha256":"b8ebdecb57e9d214c04bf4325ea53870eb9dc344e2a93894ca7eb3a41987a151","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"ReadMe.txt.cypher","sha256":"3916f62352d4a1af1c5f484ede255738507cbfae950ca51839ef549b9496abf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"HPFeb15_arrow_left[1].png.cypher","sha256":"c64f145ad7d00922c12a225f780477253a02fb37599fb32949c756b1c87d03e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"pspubws@bidswitch[1].txt.cypher","sha256":"ff7388c461372e04913b782691bb817a507c605bd5c38685b9efb6a441aceabe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"TableTextServiceDaYi.txt.cypher","sha256":"b9f5c15d1b79ddc7409017799ccbbef5e50a12c76af9e71f3a48fd23462e01b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"readme.txt.cypher","sha256":"d1fde48fe86354bd966178a9d8ccfdcbb5c9ef240cb0b5d37f636b9f3224237a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"flower_settings.png.cypher","sha256":"ba485fa01c21792fbf7197a3ec0c451e753c85883b91304818e1c8ceec89e35d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"pspubws@uplift-platform[2].txt.cypher","sha256":"668a37526cf0205e10a674fec2e0799ecdb1c7ce451884933979dce698f5050a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"name":"docked_gray_hail.png.cypher","sha256":"9aa8be6ed289b0ba2c4df61f2f57c810bac19ad076c830f50923edd1d442069e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%WINDIR%\\System32\\WSHTCPIP.DLL","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%WINDIR%\\System32\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%WINDIR%\\System32\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%WINDIR%\\System32\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%APPDATA%\\encryption_key","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%APPDATA%\\uuid_file","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%APPDATA%\\aes_key_unenc","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5.exe","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%APPDATA%\\core354535345.exe","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\$Recycle.Bin","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\9jkc6ELh","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\DAIC8Mri","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\Documents and Settings","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\PerfLogs","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\PerfLogs\\Admin","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Esl","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\PDFSigQFormalRep.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\prc","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\ENUtxt.pdf.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\SaslPrep","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\ICU","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Setup Files","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Setup Files\\{AC76BA86-7AD7-1031-7B44-AB0000000001}","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\Application Verifier","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\AutoItX","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\_readme.txt.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript\\_readme.txt.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\Worksheet.xls.cypher","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5a8ad0a97ca3e1755e5eff53"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a8ad0a97ca3e1755e5eff53"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Ransom.53E2C665 Sample 1f8936ce65fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1f8936ce65fd…. Malware family: Ransom.53E2C665. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.53E2C665 Sample 1f8936ce65fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1f8936ce65fd…. Malware family: Ransom.53E2C665. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1f8936ce65fdc41bd1a43d486426544f7832fdd6b52ba0056482e956d1c402c5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.53E2C665 Sample 1f8936ce65fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1f8936ce65fd…. Malware family: Ransom.53E2C665. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]