24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T486,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 2800f0beae6a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2800f0beae6a…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2800f0beae6a4b7dd600b276a1e45eb4c95586264731f7e9e67a36fc8040cdb6","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","2800f0beae6a4b7dd600b276a1e45eb4c95586264731f7e9e67a36fc8040cdb6"],"about":{"@type":"SoftwareApplication","name":"encrypt.exe","applicationCategory":["peexe","executable"],"identifier":"2800f0beae6a4b7dd600b276a1e45eb4c95586264731f7e9e67a36fc8040cdb6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T19a4,Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://www.symauth.com/cps0*" Heuristic match: "Microsoft.NET" Heuristic match: ";W3`d=<4T@4Qebp#Q/4\g&JqY<#omMdqy>z|Dy*)-jMoRV.%%_r7z;*BLf[sD\b+c9$s[J#e2b!/;Z~1p[tO*@[k,f7+h.CI" Pattern match: "https://blockchain.info/ru/wallet/new" Pattern match: "https://localbitcoins.com/buy_bitcoins" Pattern match: "http://www.instructables.com/id/Bitcoins-The-Complete-Guide/" Pattern match: "blockchain.info/ru/wallet/new" Pattern match: "https://localbitcoins.com/buy_bitcoinsVisa" Pattern match: "https://www.blockchain.info/ru/wallet/new" Heuristic match: "[}}8z\W Z90o$xT(8:V8r|dVb|7dys)3dH5c\4t [pH1`4P9t0(6~.hN" Pattern match: "http://mozilla.org/MPL/2.0/" Pattern match: "s.aZh/@G" Pattern match: "http://wikipedia.org/wiki/Luhn_algorithm" Pattern match: "mozilla.org/pbm-tp-whitelist;1getServiceCi[nsIPrivateBrowsingTrackingProtectionWhitelistaddToAllowListaURIpbmtpWhitelist" Pattern match: "mozilla.org/pbm-tp-whitelist;1getServiceCi[nsIPrivateBrowsingTrackingProtectionWhitelist'removeFromAllowListaURIpbmtpWhitelist" Pattern match: "mozilla.org/gfx/printsettings-service;1" Pattern match: "mozilla.org/parserutils;1].getService(Ci.nsIParserUtils)" Pattern match: "http://lists.w3.org/Archives/Public/www-xml-linking-comments/2001AprJun/att-0074/01-NOTE-FIXptr-20010425.htm" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "mozilla.org/autocomplete/controller;1" Pattern match: "mozilla.org/streamconv;1?from=" Pattern match: "mozilla.org/devtools/jsonview-sniffer;1" Pattern match: "XN4.IA/XR" Pattern match: "mozilla.org/categorymanager;1" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0" Pattern match: "pdf.js/PdfjsContentUtils.jsm" Pattern match: "pdf.js/pdfjschildbootstrap.js;5" Pattern match: "pdf.js/PdfjsContentUtils.jsm#PdfjsContentUtilsinit20171128222554cCresource://pdf.js/PdfjsContentUtils.jsmfQ;58u{srfL{ZD0JXHgEyj0k*kV^W" Pattern match: "pdf.js/web/viewer.html" Pattern match: "pdf.js/PdfJsNetwork.jsm" Pattern match: "mozilla.org/streamconv;1?from=application/pdf&to=*/*contractIDM{d0c5195d-e798-49d4-b1d3-9324328b2292}classID2w@mozilla.org/streamconv;1?from=application/pdf&to=text/htmlcontractID2generateQInsISupports%nsIStreamConverter#nsIStreamListener%nsIRequestObserve" Pattern match: "mozilla.org/intl/stringbundle;1getServiceCi-nsIStringBundleServicecreateBundle/chrome://pdf.js/locale/" Pattern match: "a0E.GZ/4h.%JF8" Pattern match: "mozilla.org/binaryinputstream;1createInstance" Pattern match: "mozilla.org/network/serialization-helper;1" Pattern match: "mozilla.org/embedcomp/command-params;1" Pattern match: "mozilla.org/xre/app-info;1!nsICrashReporterinit" Pattern match: "Prefetcher.jsm/defineLazyServiceGetterSystemPrincipal=@mozilla.org/systemprincipal;1nsIPrincipal#contentSecManagerK@mozilla.org/contentsecuritymanager;13nsIContentSecurityManager[ADDON_CONTENT_POLICY_SHIM_BLOCKING_LOADING_MSYADDON_CONTENT_POLICY_SHIM_BLOCK" Pattern match: "mozilla.org/childprocessmessagemanager;1getServiceCi" Pattern match: "mozilla.org/io/string-input-stream;1createInstance" Heuristic match: "CW" opened "C:\Users\desktop.ini" with delete access "" opened "C:\Users\uSxdd1J\ntuser.ini" with delete access "" opened "C:\Users\uSxdd1J\Videos\desktop.ini" with delete access "" opened "C:\Users\uSxdd1J\Searches\desktop.ini" with delete access "" opened "C:\Users\uSxdd1J\Searches\Indexed Locations.search-ms" with delete access "" opened "C:\Users\uSxdd1J\Searches\Microsoft Outlook.searchconnector-ms" with delete access "" opened "C:\Users\uSxdd1J\Saved Games\desktop.ini" with delete access "" opened "C:\Users\uSxdd1J\Pictures\desktop.ini" with delete access "" opened "C:\Users\uSxdd1J\OneDrive\desktop.ini" with delete access "" opened "C:\Users\uSxdd1J\Music\desktop.ini" with delete access "" opened "C:\Users\uSxdd1J\Links\desktop.ini" with delete access "" opened "C:\Users\uSxdd1J\Links\Desktop.lnk" with delete access "" opened "C:\Users\uSxdd1J\Links\Downloads.lnk" with delete access "" opened "C:\Users\uSxdd1J\Links\OneDrive.lnk" with delete access "" opened "C:\Users\uSxdd1J\Links\RecentPlaces.lnk" with delete access "" opened "C:\Users\uSxdd1J\Favorites\desktop.ini" with delete access "" opened "C:\Users\uSxdd1J\Favorites\Windows Live\Get Windows Live.url" with delete access "" opened "C:\Users\uSxdd1J\Favorites\Windows Live\Windows Live Gallery.url" with delete access "" opened "C:\Users\uSxdd1J\Favorites\Windows Live\Windows Live Mail.url" with delete access "" opened "C:\Users\uSxdd1J\Favorites\Windows Live\Windows Live Spaces.url" with delete access27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2800f0beae6a4b7dd600b276a1e45eb4c95586264731f7e9e67a36fc8040cdb6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790439540399,"unified_at":"2026-09-26T16:19:00.399Z","metadata":{"hashes":{"sha256":"2800f0beae6a4b7dd600b276a1e45eb4c95586264731f7e9e67a36fc8040cdb6","sha1":"6c31f7a27c9a8733a6add641e309b6d4e2f4b2fe","md5":"752f0af4abdb59261312521b0c27e03a","sha512":"5debbaf86a2fc4eb733f7a69f4682db739090f464b642db6927734b04dd815ebb2d634e2c69f2d733376184fd75515094b4d6af3afbd4cea9173e0ee02799328","ssdeep":"3072:DPKs+Na3IrKJolntGDT5Xtjtmn7dfQzcR9T56xETMgqo:+ntGDjIFQi9TEkY","ssdeep_chunks":["3072:DPKs+Na","3072:PKs+Na3","3072:Ks+Na3I","3072:s+Na3Ir","3072:+Na3IrK","3072:Na3IrKJ","3072:a3IrKJo","3072:3IrKJol","3072:IrKJoln","3072:rKJolnt","3072:KJolntG","3072:JolntGD","3072:olntGDT","3072:lntGDT5","3072:ntGDT5X","3072:tGDT5Xt","3072:GDT5Xtj","3072:DT5Xtjt","3072:T5Xtjtm","3072:5Xtjtmn","3072:Xtjtmn7","3072:tjtmn7d","3072:jtmn7df","3072:tmn7dfQ","3072:mn7dfQz","3072:n7dfQzc","3072:7dfQzcR","3072:dfQzcR9","3072:fQzcR9T","3072:QzcR9T5","3072:zcR9T56","3072:cR9T56x","3072:R9T56xE","3072:9T56xET","3072:T56xETM","3072:56xETMg","3072:6xETMgq","3072:xETMgqo","6144:DPKs+Na","6144:PKs+Na3","6144:Ks+Na3I","6144:s+Na3Ir","6144:+Na3IrK","6144:Na3IrKJ","6144:a3IrKJo","6144:3IrKJol","6144:IrKJoln","6144:rKJolnt","6144:KJolntG","6144:JolntGD","6144:olntGDT","6144:lntGDT5","6144:ntGDT5X","6144:tGDT5Xt","6144:GDT5Xtj","6144:DT5Xtjt","6144:T5Xtjtm","6144:5Xtjtmn","6144:Xtjtmn7","6144:tjtmn7d","6144:jtmn7df","6144:tmn7dfQ","6144:mn7dfQz","6144:n7dfQzc","6144:7dfQzcR","6144:dfQzcR9","6144:fQzcR9T","6144:QzcR9T5","6144:zcR9T56","6144:cR9T56x","6144:R9T56xE","6144:9T56xET","6144:T56xETM","6144:56xETMg","6144:6xETMgq","6144:xETMgqo","3072:+ntGDjI","3072:ntGDjIF","3072:tGDjIFQ","3072:GDjIFQi","3072:DjIFQi9","3072:jIFQi9T","3072:IFQi9TE","3072:FQi9TEk","3072:Qi9TEkY"],"imphash":"784a8c5e0b8c181edd21a34b2033106a"},"file_info":{"file_name":"encrypt.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":139776,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1520037324000,"last_seen":1678593390000,"last_multi_scan":1678593390000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["dyzap","ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":5,"suspicious_count":11,"malicious_count":5,"total":21},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.GlobeImposter.D4411AB5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Necne.AB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-71156494!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.GlobeImposter.D4411AB5 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.FV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00502c261 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXDX-LS!752F0AF4ABDB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.eximhz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/GlobeImp-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.2D96B14B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.2D96B14B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.Win32.1435294","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"scriptCache-child.bin\" has type \"data\"\n \"WdfCoInstaller01009.dll\" has type \"data\"\n \"Microsoft.VisualStudio.Data.Interop.dll\" has type \"data\"\n \"vstlbinf.dll\" has type \"data\"\n \"VsWizard.dll\" has type \"data\"\n \"Microsoft.XmlEditorUI.dll\" has type \"data\"\n \"Microsoft.VisualStudio.vspWmiEnum.dll\" has type \"data\"\n \"DirControl.dll\" has type \"data\"\n \"cmddef.dll\" has type \"8086 relocatable (Microsoft)\"\n \"javaws.exe\" has type \"data\"\n \"urlCache-current.bin\" has type \"data\"\n \"Uninstall.exe\" has type \"data\"\n \"airappinstaller.exe\" has type \"data\"\n \"msvbprjUI.dll\" has type \"data\"\n \"Compsvcspkg.dll\" has type \"data\"\n \"securitypack.jar\" has type \"8086 relocatable (Microsoft)\"\n \"autologon.reg\" has type \"8086 relocatable (Microsoft)\"\n \"Microsoft.WizardFrameworkVS.dll\" has type \"data\"\n \"WinDivert.dll\" has type \"data\"\n \"Desktop.lnk\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"informative","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata with unusual entropies 7.51014391054","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"HAPUBWS.contact\" containing the Windows username \"HAPUBWS\"\n Found dropped filename \"HAPUBWS-PC-20171204-1725.log\" containing the Windows username \"HAPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\ntuser.ini\"\n \"\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Saved Games\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\OneDrive\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Links\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Favorites\\Links for United States\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"csproj.dll\" has type \"COM executable for DOS\"\n \"Microsoft.VisualStudio.vspSqlEnum.dll\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%LOCALAPPDATA%\\encrypt.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"HOW TO DECRYPT YOUR FILES\" (Source: instructions.html, Indicator: \"decrypt your files\")\n \"

Your files are encrypted!

\" (Source: instructions.html, Indicator: \"files are encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1781 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"encrypt.exe.bin\" has an entrypoint in section \".rdata\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n RegOpenKeyExW\n CopyFileW\n GetModuleFileNameW\n GetDriveTypeA\n GetFileAttributesW\n GetTempFileNameW\n GetFileSizeEx\n CreateThread\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n ShellExecuteExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%LOCALAPPDATA%\\encrypt.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"51/67 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"51/67 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"instructions.html\" which has been seen in the context of ransomware (Indicator: Instructions.html)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"\"ntldr\"","origin":"File/Memory","relevance":9,"id":"string-0","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":23,"dropped_files_count":0,"extracted_files_count":143,"files_written_count":65,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["dyzap","ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5a99b7087ca3e14bf26011b3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DeepScan:Generic.Ransom.GlobeImposter","submit_name":"encrypt.exe","analysis_start_time":"2018-03-03T01:22:23+00:00","indicators_count":{"informative":5,"suspicious":15,"malicious":6},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}],"processes":[{"pid":3772,"ppid":0,"name":"encrypt.exe","command_line":"","sha256":"2800f0beae6a4b7dd600b276a1e45eb4c95586264731f7e9e67a36fc8040cdb6","normalized_path":"C:\\encrypt.exe","uid":"00011977-00003772","icon":"$27"}],"all_imported_dlls":["gdi32.dll","sspicli.dll","shell32.dll","ole32.dll","imm32.dll","cryptsp.dll","kernel32.dll","lpk.dll","usp10.dll","advapi32.dll","rpcrt4.dll","cryptbase.dll","msctf.dll","rsaenh.dll","ntdll.dll","wow64win.dll","msvcrt.dll","sechost.dll","wow64cpu.dll","user32.dll","KernelBase.dll","shlwapi.dll","wow64.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"instructions.html","sha256":"80b98b8febabd52ac86328d8b148f9b358250ddcfcc610ce806e962f677974ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"settings.sol","sha256":"882df7a84112e2f7c37db1e1bd5e9d2ad42bfe2492968770edd0da32db9dc91f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"airappinstaller.exe","sha256":"cabb2797f390fb9b64c9be746921176ec850bfafcb863ff5bd78ba29bbc16c8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"digest.s","sha256":"3699338178cbae7133c2f1e85677aa607ced64142b71604b85d780900aa9598e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"InstallTime20171128222554","sha256":"7c458a9ecc1287bb3b83f442064c81a928318fe5e19300dbb5f2f89e791e441a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"SiteSecurityServiceState.txt","sha256":"0e303d472914f9596d886825377623fe2cc90e9b9712b111f606b3fcc3856f03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"addonStartup.json.lz4","sha256":"bb51560c13a795f08a0744872b253e867f586991e877394f08c82fe3313ccfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"addons.json","sha256":"89299cb1dfa2c50d0c36b665135b1848bd0c1807cf6cdc674e0e770f2cc530bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"blocklist.xml","sha256":"bbed1d375cc0838e2af31dcfe339b5f07f78d89d10ea46cef63ddddb81e331b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"cert8.db","sha256":"c0a58dd815385dd4af591f83c5fbd7e6f89fd8859c6b4567605781d1658b28b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"compatibility.ini","sha256":"b16851a52a968c8f532d9ebd70d64705beccf9a33107d469855bab471a7e664e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"containers.json","sha256":"6ffc0369d6ffdb4ef6b52461dfaec7a8a3792405ac694acb67a971bf27d2662f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"content-prefs.sqlite","sha256":"9fbbb52522930c04fca13ba739f6eae8f383331e12fc729ef6c1a7e1961cc2f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"cookies.sqlite","sha256":"3419a42796b7362b93ca4f3d62e8898b6820371d0e6926a6e7b66201fc1808a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"store.json.mozlz4","sha256":"0eb5ca0d341ab6f458af6c4b694850c85a8119d4a6988ba878dfcaadc68e5d0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"1512412258722.ad8bd4e2-9c4f-4b26-a9ed-769adf977d4f.new-profile.jsonlz4","sha256":"048560271104e08fd5d9c38b7e4bc188542d25e2696de832f0acb6e0ec47cbd9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"1512412258747.659168a0-3306-404a-8eac-c9fbb0a73720.main.jsonlz4","sha256":"fb63407a7afcdcd4d2074ddf9b182f12f74017bcf6a30ea98f79e8f599052f68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"1512412258750.d6e253cd-a732-457b-a82f-f4c82271fcc7.first-shutdown.jsonlz4","sha256":"e7c71d6b17ba58db14b3d881d14a40ab0e74a827b0849db846a6067e2df6fcfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"1512412264839.472b9561-cbc6-4c28-8f86-97d0384eaa1f.health.jsonlz4","sha256":"407dfcae961cfc1a485da210d20e21845d284b582b9619a4c8c252eceaf30477","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"1512412264884.d7dd44d3-ca34-450e-98ad-39200ea8ea8f.health.jsonlz4","sha256":"ef8319d7f6b9a6e71d711543edf8a79cbf0848c49156835d09b38bdaa9e3c252","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Desktop.lnk","sha256":"28165ff32bd4689483b02fe409d555786c1e114f37dd6a50b103dd195103f39b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Downloads.lnk","sha256":"19aba65f9e33a76041ea8df781317a33f34abb04f72c0e922dc8c1c61782c9c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"OneDrive.lnk","sha256":"ce5e749fd5dcbdc9346d36d5f4775a72d94df39e8e317587155bf77cd16d9288","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"RecentPlaces.lnk","sha256":"7d96faf09ff32495990dd26caf593db811b77f00fac0f9d3ec7ab925f9cf5af4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"scriptCache-child.bin","sha256":"b800ef0613a19a65d070b5dd006add65c32509c9c53dff4c9cf77075e3910be0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"WdfCoInstaller01009.dll","sha256":"ccf1ac9fd6d0913d50819d79b07b5307467f0b295b9110f781af037620f3d98e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.Data.Interop.dll","sha256":"bb616f1a6e1d0ccfcb076f5d55cc3eb0b8368de29b9ae542f9cacb1ffdac2097","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vstlbinf.dll","sha256":"7a0a42da1775b93fa89444d1a33d4c7406b4864577a3d68eb675756a4c0cff87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"VsWizard.dll","sha256":"0a149c17f013e57fbda92c917bbe9ba0f5693fdbe380711879fd341c8dd97863","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.XmlEditorUI.dll","sha256":"58709f5a3b4575ce2ef02af5f88b47d4fafedcd901d8d265500d5e0e08b755a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.vspWmiEnum.dll","sha256":"fb2f3e93f716ff059fe0371aa8cfe0dfb5b0b5965c410ac7255d7642f701bb98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"DirControl.dll","sha256":"4cbf69fed1d10be80ae99e143fdb072e55bbd9d10d5c82b30b32e55003df6602","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"cmddef.dll","sha256":"9cacccc43696ab425fb3fb1c66883b9621daf94660909b7b1c6a6483ae594af6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"javaws.exe","sha256":"570be8cabd459ee69103815ef4e0e61d5990c193dd74c9bfb6649e3c4bfec75f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"urlCache-current.bin","sha256":"2a56cdafd40654475be9133daaa80df0a98e805d1d07b3b92d8e00a6b9be5a06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Uninstall.exe","sha256":"b4c936477a080ac1f7a995d6f112feffb0b008d0d1b1abda43f414c19c5be7b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"msvbprjUI.dll","sha256":"bbfbf90e085695ee26ab20cfbc8bf5bbb3478c021db78104a75ee6806020c915","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Compsvcspkg.dll","sha256":"3cf7bd75a6622fd01e917a293c70cd0fa72afab0798f7d2315b38718d15293fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"securitypack.jar","sha256":"b0bdb0a29a103d49cc5f8c42a0bf6962ea28555e6bf4e01721108e57127e49fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"autologon.reg","sha256":"55647b48dbaefbab506453523189bc7d85e3fdfedd1da495ec5f44a4ce62f5bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.WizardFrameworkVS.dll","sha256":"adac1d88c136441d3f3fc89d3b576be56f2b384ef0293412236e292ab0d018b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"WinDivert.dll","sha256":"661544ec3af3f9500b9bc9f24fefd7838dbce05156bdda33c8497037183d9b01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"maintenanceservice.exe","sha256":"55cc3a94da0f93950292e67d61353a1157a5effde73a585db10200f8a64f6ce2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"rdbgwiz.exe","sha256":"2ad7279e13e538fe5fdd09d5b83fc50bebdb0e3fa84c9291906158402cd51951","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vsdebug.dll","sha256":"6164c0da1da910d6e83a47ee87ac2617a051cd12677525f8ece2f2dda86a384d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.DataTools.Interop.dll","sha256":"11f3f972e8389a79bd673d59509daa59d47312d384f8114a787035860e5e5cf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vshost32.exe","sha256":"e3af002d8cb41dbc0276b20f0a272eed0fb29d599603388851502816dbde94f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"javaw.exe","sha256":"ed3728a26021bd978fd7f9d8a12dabc9cfebed139d2926e6e5583c2f6d3c7e56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.ConfigurationUI.dll","sha256":"226da13b1b4ff17383ce5cba35c69f82648a9f3ee18b45bb63fb6528400b04df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"KMSSS.exe","sha256":"4df990847133b78827f0d513d132352de6249338015667230d25cc24a62d93ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"WinDivert.inf","sha256":"2ed4c782f0ac4f733d53f6be3a4b1935cf43ffaaf5caa6fd2154d6818e39587b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vdt80ui.dll","sha256":"5c26f757e094a416a7731d163d307584a76e3c3e91d53e731d79d0a8b01519d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.Debugger.dll","sha256":"b1a838460db64251a5eb7a04a5d2f97b81078650d28b52f2a427be78b49d97ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"dbghelp.dll","sha256":"579f402cf1cfcb3d2b1316d1477678ebc2cc3e3cb4cc7e6f3bb3e7f63df3a33a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.HostingProcess.Utilities.dll","sha256":"26fcd6de7fb9d18df00075e076910b0fda9dce0b30febce8b9faeb8e2325e64c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"scriptCache-current.bin","sha256":"4e581c640115363fbf51c39f766475467187470611b7b3519036b9d531d0b7c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"cpde.dll","sha256":"f4e1078a0b77e80114ea0be48d86ba624629a3bc291d09cfca798f223c380859","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"VSTAProject.dll","sha256":"4f5a4fd08c7f8f087e55ba9d6e9dc78c01f4f3746bd4c790f65ae6c797e964e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"cscompee.dll","sha256":"828b1a47ec0abb55e059f4faef1eea91fdf6dc14e2ef4bf89658040d23df0771","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"mssdi98.dll","sha256":"e00a813cc4ef81c29937a2e2fa16ffa884a57b25ee98c7f649898bab1e24463b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vdt80.dll","sha256":"7d5eb44f3d6accbbe3ba63009487200fe23b6f2646d05dd242e479b7f1aec9a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.TemplateWizard.dll","sha256":"b5433939ad7fc3b76624f248593b8187978d8d891218bfa2e4e480ef80ce4937","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"mspdbsrv.exe","sha256":"8210b6778b22ff101221e831c76d365ea831dd1d221e96f2c7e4aebc57f10382","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"dirprj.dll","sha256":"b00f9c44f37d1ea846f5e1b6db6ff9f74d2834890a37f22079b32798665e9063","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"compluslm.dll","sha256":"e4d7aadc6fccd2f642fe4913c694cc7db57b22755828988d3748a05f3c8e8a82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"ProjectAggregator.dll","sha256":"6b84c66ca894a917cb785ac8a69b234099d9faaa182b9adc758868fbb4fe7a2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.ToolBoxControlInstaller.dll","sha256":"a50c32221127896ff092e49f16c47e7eee9bd3938b9b1d71f82e9d7c8a14daea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll","sha256":"24b53f506dc7be61beb70ec3c8e8bbd7fd9f96a2d1c4b9c08de08f6c8522c859","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"cslangsvc.dll","sha256":"5ac8e40f9a1a861f9660d0f87413852fc7f493ae375900607f8eefa9dd757eb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"csformatui.dll","sha256":"731c3c40ee3f18f1c076f91aa1f4e6e04bd7c3d7bfe0037da0081bae7d869aa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"TunMirror2.exe","sha256":"99d08ff0e30eab01b7e701b8e112374ea7016f422f6bf1ec6df14d2e4bdc2ac1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.vspSqlTDiagM.dll","sha256":"bf52fa491ad6734d02f0b1a8a34dbda072919981713c15eee614b78c4179995c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"csprojui.dll","sha256":"20eb51eeb8f173707ca6ea454a1ef44c5fec9e0b92b1d2e922bd124fd5be5c13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"custsat.dll","sha256":"488a0e0991bd1d2ff75a530c46b830eee38dbbdfee894f4d159242a29b1c9701","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vsdebugui.dll","sha256":"1bcbca873e5a2efab30d61d09bc82e2fbeb8df8b20a84c4c05a4c77d1b814856","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"csproj.dll","sha256":"f0933e78236ac3edefa89ad69b7f90ddee65840fd11afa5223bc43b792b13bb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"VSTAClientPkgUI.dll","sha256":"aa54c55b878aa5fb2d42843a5a24a165c8b18f6984bb80f55856cc99b336339f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"msdis150.dll","sha256":"a5c7107a2d10009d5b12a6c1afed295ad77e04204cbf05056303a7cc4e482b8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"java.exe","sha256":"db264b3cbf9d4105a22d57929b480a0624c357620cc585adbfad7738b5bc3f19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vdt80pui.dll","sha256":"d042317e78d60e5605aa3d5cd2333899e0790e81bde054d8b1d7d49af119faa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"tap0901.cer","sha256":"3bf7e4f21704c1d9ce4865d06a43027c15670ca46172c348c47b179fbb9c0c28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.vspConnectionInfo.dll","sha256":"5212e10bea1f00f0b846806419411168fe1d70db11bfa6e904d4d9e9db3f4982","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"mspdb80.dll","sha256":"dfe92c9d71b504add605b4f83be274728b1b283fa95c3e66757d9c51f5728bad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"DirControlUI.dll","sha256":"71e3b77250d790d3813716c3467199f42f55415beff60afc23ef2615bbb518ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"autoexpce.dll","sha256":"9df4e873a265da313e1088ee2c8b0f69e19216c082e4b0f9026c2d31e5641f40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.Debugger.DataSetVisualizer.dll","sha256":"efbf2261eebf1d635c1e75bd6d3325b8f470cbe89cf27a263a90264f4c5a73a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.vspGridControl.dll","sha256":"aa76b2a038a800a29b162a167495cefb2f51d37c5ce8ddb70ce6d024f2845abb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"VSTAClientPkg.dll","sha256":"f9ff70b10288b7c181f893fda127b5df66d55376d67b76b981da91797bf6561e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"mspdbcore.dll","sha256":"4eccb97a0142033524e0e62e40f28a647a97cd591885614f20942ae9ee310c13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"TunMirror.exe","sha256":"6058ee616ba26ce5c4fadb108ea0f82f3e72f09ef8967b124c406673bbdcb7ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vslog.dll","sha256":"d011d31ec99ae97464d55964e0135fa7e1a987ac8c1142f0541b384f6dab61c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vc_runtimeMinimum_x64.msi","sha256":"9d4b164b31442c73407b5be7c315332bb8437087674eee76e8b6ce2b99f77a9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"tapoas.cat","sha256":"b91590c6eb549aebf1c367ce4bc963559b11634c9f42ce63556af6715fe2c997","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"VC_redist.x64.exe","sha256":"82259e8fa5f18dfa298aefa49195a057a6365a8efd8b1471d640418133201fd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.Data.ConnectionUI.dll","sha256":"596a019070f61be44a35061e1484e6b8588984c631f8a57911a0bc2b6357e0ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"MakeZipExe.exe","sha256":"78aff0c85d19f79fcb6578b01990690aa710bc3ba5b27f1cee97dc013f069260","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.DataTools.dll","sha256":"185ba464c4e81d6157bb08a1118068878350b2f32fd708ea638aa398acb042f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"msvb7.dll","sha256":"98736f1d8c349df9c2e4e8dd591e1933a411f2f5e66af16f24ea5c58387dfd83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"rpcapd.exe","sha256":"d74c84c4f58d284f3e894242625f5863f33bec1aeaa0ebac17f31f0a735a49d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.vspRegSvrEnum.dll","sha256":"e1a1d2c240b81ee5536cc441f3b63104172d38329d552ea5604ea5415d34ee2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vstamnu.dll","sha256":"9e3bb5c00dc88778e88dcf108ffb3da2420ac9373fca8ce5e0981d79145bb166","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.vspServiceBrokerEnum.dll","sha256":"b90e0d2f45e925c71e25d308cd144a93af4694a6c5e08c5f423aa81d2e403e17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"OemVista.inf","sha256":"e9a5b3c9950db408047e4c009976d0cde24f301aeff5007763b6f68c0c3d1995","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"FakeClient.exe","sha256":"b7281eb7d997835e05bb5f799564900c02f1007826a574bc33a05d0ccec6a28d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.CSharp.Services.Language.dll","sha256":"c0f4486e8b3d349ee9de492bd925dd5f651fac872789bfdc17ee6768f52cd4d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.Data.ConnectionUI.Dialog.dll","sha256":"8e13f9baa4ccd35392e5aef2b3abe696eb7d10067a4888fb73b56dd3fce22f9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vdt80p.dll","sha256":"46a2c039ee5318e49a7584823ee44f3d7d466d554434162de2998307b974348b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"tapoas.inf","sha256":"2d809d4393d06dd7f0f6fb8fe8dc56975b5548da6bff2458e790dd6c17c70449","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vsta.exe","sha256":"7a9ccde4184fddb655b5045653052f6381e32f49b04e651ab666a27b3de8a5ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"ZipExeStub.exe","sha256":"5a14800b68fea088d65b393f8538b42e90790dbf485fc9610e45d1a005d1ad80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.CSharp.Options.dll","sha256":"6537f8803d5da01535dc784bcc7b89d14b0bad5b37e5cf9171b6c0abdcb66aec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.WizardFramework.dll","sha256":"f6448f01acfad14226a64f3f00edc0fea53201cb827f87fe965345c0e53f60f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.vspSqlEnum.dll","sha256":"e266abac3c617a70af26485c3c057be74bbacdcb7c35792befbcf6727648b1c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"msdbgui.dll","sha256":"a71f95a2cf07f710fa16b4797d173ec56bd1a719083463a360ad62a317b0150f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"autoexp.dll","sha256":"10916d2aa01eabfc54770437047577bfc91da0a4e0b9882f34376375b91b6c93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"msvbprj.dll","sha256":"c7620d535c75844549bcbf192e0afe764fb825fc5ec076f36c6239af29faa0a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"setup.exe","sha256":"ffb19f64ca9cf477ebefe098c80ba346290d8fb4c6bcb25ee8f379e3c5af742a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.XmlEditor.dll","sha256":"963a04324b34263f5bf22a472fec76f697923df2fb2ec53883d73d1b82ff1ba0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"AcroRead.msi","sha256":"987251788b1b610c2efd2f1813fd4ae23d27db001e8affb89c2f2754d6ee218d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"compsvcspkgui.dll","sha256":"aa2b827ee94f783b47430bfceaf47f786c2fbf81587ca15901ccbfb42b01a3a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"ptun0901.cat","sha256":"b8db30062945875fd45b2f557c0d43b55be92952d4ff02e85cbf1e8505cdd270","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.ExportTemplate.dll","sha256":"154dbdac80a5707419cbf3a25c5db0621adf8005077b719f4dc05e1a4916b509","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vc_runtimeAdditional_x64.msi","sha256":"3a1e8f47033b76cd49be48bc0afa1508e4a2633c9d20dbca79c823231c108007","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"devcon.exe","sha256":"fc660c2c30a2174d2376964919afae30b7b7f031f7ebb13e964d36d3f8898c12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"cscompeeui.dll","sha256":"81779316482d4061e463d1e8788cdb4725668e1890d69121e62e3980345f3180","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vssln.dll","sha256":"9120b8f36207c73a68a7a6cb687d0085e156b1f39e4797a07d86870958e0ad83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"shmetapdb.dll","sha256":"d54ae960fccad880244e98a31a3f0890c6e9a8049fa20aaeab5220b1a0bd631c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"scriptCache-child-current.bin","sha256":"308f48e8384b432b78bf810d44ed0c6a0d217169bc755d647b17406556eba7d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"cslangsvcui.dll","sha256":"7731607e42002f3d7e7b3b77d41627fb5b062629d4cef59ba20e22ef3440fb7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"VSTAProjectUI.dll","sha256":"5b306dc5a3f75e68c2963ba4c49e7a69d51c77a74f01f015e7fa2033a56817ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"UserControlTestContainer.exe","sha256":"99a27acd0f9ad6ceb5239610af0f3cc2ed99d0812b61ea252dd8d2c1a3a89938","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"oas_sert.cer","sha256":"c7b13d97171bb9cd25ff48339d4fc96ca3a9b46cce70d2aa4159abbca4a97a87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.Data.dll","sha256":"83a7baba03fe2273a870a4831946c8ba36fee8a09611fcc5eb544e74aa6ed535","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"encmgr.dll","sha256":"f707e5ebcfc86f4b136d3a08940d16cb2e2bd5b7c7c8a31c8aa26c8694ba67f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"urlCache.bin","sha256":"167865de1aa139f2352008ecf161c4794ef5b87b939c255b9fe1daf06bc592f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Mozilla Firefox.lnk","sha256":"c636db0d5a67ff304b64e72b7f66b7dc9e5798013b4e83dd57efe51d1bf9c7eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.vspSmoEnum.dll","sha256":"4e665453f9fb37be27f674e4c498a3e4b68a0a58b252904ad29bf9b61be84234","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.vspBatchParser.dll","sha256":"bbea281981fc14ed7b631395fd8b92a429072bba4ae3544b382c7affc210bc7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Microsoft.VisualStudio.vspSmo.dll","sha256":"239bd2f474b737446d798d95397d8110d7342eda9884b10a1929299ca892804d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"dirprjui.dll","sha256":"7169953106a74b557643da34211775d5d2a0e7994d8922912fe0abf6b1f3fa1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"vshost.exe","sha256":"16a7fc97e39bdbeaf8bee9cfae03d5d2498dd343ce51f7358ce1b7a5af20d94c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"msenc80.dll","sha256":"2566092bf0252735c1c2a78969ddd2389ee4993d8a443441de22291d97f67f2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"name":"Acrobat Reader DC.lnk","sha256":"301bc0914c9666d7aba21f87e6efd5f81a088c9c3ae3e8fb7d79998bb4c8a418","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"C:\\encrypt.exe","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%LOCALAPPDATA%\\encrypt.exe","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"C:\\encrypt.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%LOCALAPPDATA%\\encrypt.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%PUBLIC%\\64EC720F6CB57058EEC94BC3E43F591E411458154B29EC498577A6D26873C0B7","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"C:\\share\\1520036587831$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"C:\\share\\1520036587831$OK","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"C:\\Users\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Videos\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Searches\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Saved Games\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Pictures\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\OneDrive\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Music\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Links\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Favorites\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Downloads\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Documents\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Desktop\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%USERPROFILE%\\Contacts\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Wireshark\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\AlternateServices.txt","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\parent.lock","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\SecurityPreloadState.txt","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\storage\\default\\about+newtab\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\storage\\default\\about+newtab\\idb\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\sessionstore-backups\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\datareporting\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\datareporting\\archived\\2017-12\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\crashes\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\airappinstaller\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.xinhuanet.com\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.toshiba.com\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.sprint.com\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.mlbstatic.com\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#www.friv.com\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#v.6.cn\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#tagged.com\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#static.baifendian.com\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#sprint.com\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#secure-static.tagged.com\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#script.auction.co.kr\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]},{"path":"%APPDATA%\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#player.hulu.com\\instructions.html","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5a99b7087ca3e14bf26011b3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a99b7087ca3e14bf26011b3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 2800f0beae6a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2800f0beae6a…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2800f0beae6a4b7dd600b276a1e45eb4c95586264731f7e9e67a36fc8040cdb6"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 2800f0beae6a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2800f0beae6a…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2800f0beae6a4b7dd600b276a1e45eb4c95586264731f7e9e67a36fc8040cdb6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 2800f0beae6a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2800f0beae6a…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]