26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Stop.Generic Sample 2fec3892efa6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2fec3892efa6…. Malware family: Ransom.Stop.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a","keywords":["Malicious","Ransom.Stop.Generic","malware analysis","sandbox report","threat intelligence","2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a"],"about":{"@type":"SoftwareApplication","name":"System.exe","applicationCategory":["peexe","executable"],"identifier":"2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Stop.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T409,".exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" ".exe" touched file "%APPDATA%\Microsoft\Windows\Recent\desktop.ini"28:T46c0,Pattern match: "https://www.youtube.com/watch?v=xKIIFlqz4sI/" Pattern match: "tNh.typ/t5N0t|f3t{W4tVP5tu]6tqw8t}v:tw[?tj{@t\iAtAYCtruDtE`KtTjUtByWt" Pattern match: "aEa6a2a.aFa/aOa" Heuristic match: "sakae.chiba.jp" Heuristic match: "equipment.aero" Heuristic match: "bjerkreim.no" Heuristic match: "gyeonggi.kr" Heuristic match: "chieti.it" Heuristic match: "ugim.gov.pl" Heuristic match: "rishirifuji.hokkaido.jp" Heuristic match: "tomiya.miyagi.jp" Heuristic match: "dsherad.no" Heuristic match: "unusualperson.com" Heuristic match: "unazuki.toyama.jp" Heuristic match: "forgot.his.name" Heuristic match: "dyndns.org" Heuristic match: "ma.leg.br" Heuristic match: "hiroo.hokkaido.jp" Heuristic match: "showa.gunma.jp" Heuristic match: "yawata.kyoto.jp" Heuristic match: "cagliari.it" Heuristic match: "game-host.org" Heuristic match: "dagestan.ru" Heuristic match: "pokrovsk.su" Heuristic match: "tokamachi.niigata.jp" Heuristic match: "hirono.fukushima.jp" Heuristic match: "forlicesena.it" Heuristic match: "tsushima.nagasaki.jp" Heuristic match: "kawaba.gunma.jp" Heuristic match: "ookuwa.nagano.jp" Heuristic match: "masuda.shimane.jp" Heuristic match: "servep2p.com" Heuristic match: "portal.museum" Heuristic match: "dagestan.su" Heuristic match: "fukushima.jp" Heuristic match: "merseine.nu" Heuristic match: "ditchyourip.com" Heuristic match: "iraq.museum" Heuristic match: "bronnoy.no" Heuristic match: "ogasawara.tokyo.jp" Heuristic match: "furukawa.miyagi.jp" Heuristic match: "takayama.nagano.jp" Heuristic match: "koto.tokyo.jp" Heuristic match: "loyalist.museum" Heuristic match: "gdansk.pl" Heuristic match: "chosei.chiba.jp" Heuristic match: "nagawa.nagano.jp" Heuristic match: "cheltenham.museum" Heuristic match: "casadelamoneda.museum" Heuristic match: "futuremailing.at" Heuristic match: "trentinoa-adige.it" Heuristic match: "kizu.kyoto.jp" Heuristic match: "krehamn.no" Heuristic match: "katagami.akita.jp" Heuristic match: "stre-toten.no" Heuristic match: "johana.toyama.jp" Heuristic match: "kawasaki.miyagi.jp" Heuristic match: "dnsdojo.com" Heuristic match: "toki.gifu.jp" Heuristic match: "georgia.museum" Heuristic match: "house.museum" Heuristic match: "is-a-musician.com" Heuristic match: "servehttp.com" Heuristic match: "oto.fukuoka.jp" Heuristic match: "nordkapp.no" Heuristic match: "boxfuse.io" Heuristic match: "shell.museum" Heuristic match: "mt.eu.org" Heuristic match: "yashio.saitama.jp" Heuristic match: "mutsuzawa.chiba.jp" Heuristic match: "ina.ibaraki.jp" Heuristic match: "hembygdsforbund.museum" Heuristic match: "judygarland.museum" Heuristic match: "suita.osaka.jp" Heuristic match: "saikai.nagasaki.jp" Heuristic match: "mo-i-rana.no" Heuristic match: "skydiving.aero" Heuristic match: "hino.tokyo.jp" Heuristic match: "phoenix.museum" Heuristic match: "kvalsund.no" Heuristic match: "k12.ia.us" Heuristic match: "heguri.nara.jp" Heuristic match: "palermo.it" Heuristic match: "control.aero" Heuristic match: "verona.it" Heuristic match: "traniandriabarletta.it" Heuristic match: "takamori.kumamoto.jp" Heuristic match: "skedsmo.no" Heuristic match: "kyotamba.kyoto.jp" Heuristic match: "itami.hyogo.jp" Heuristic match: "ginowan.okinawa.jp" Heuristic match: "griw.gov.pl" Heuristic match: "altoadige.it" Heuristic match: "school.museum" Heuristic match: "gs.jan-mayen.no" Heuristic match: "mari-el.ru" Heuristic match: "lib.az.us" Heuristic match: "wanouchi.gifu.jp" Heuristic match: "higashiyamato.tokyo.jp" Heuristic match: "textile.museum" Heuristic match: "kitakami.iwate.jp" Heuristic match: "mansions.museum" Heuristic match: "randaberg.no" Heuristic match: "is-a-guru.com" Heuristic match: "eisenbahn.museum" Heuristic match: "re-og-romsdal.no" Heuristic match: "parachuting.aero" Heuristic match: "muko.kyoto.jp" Heuristic match: "tsukiyono.gunma.jp" Heuristic match: "freiburg.museum" Heuristic match: "higashiyama.kyoto.jp" Heuristic match: "kamagaya.chiba.jp" Heuristic match: "ibaraki.ibaraki.jp" Heuristic match: "chikuhoku.nagano.jp" Heuristic match: "mima.tokushima.jp" Heuristic match: "noheji.aomori.jp" Heuristic match: "redirectme.net" Heuristic match: "tahara.aichi.jp" Heuristic match: "nishitosa.kochi.jp" Heuristic match: "stpetersburg.museum" Heuristic match: "gyeongnam.kr" Heuristic match: "*.0emm.com" Heuristic match: "shimoichi.nara.jp" Heuristic match: "civilaviation.aero" Heuristic match: "la-spezia.it" Heuristic match: "seiyo.ehime.jp" Heuristic match: "is-very-bad.org" Heuristic match: "k12.ct.us" Heuristic match: "b.ssl.fastly.net" Heuristic match: "dyndns-wiki.com" Heuristic match: "onjuku.chiba.jp" Heuristic match: "otoyo.kochi.jp" Heuristic match: "benevento.it" Heuristic match: "in-addr.arpa" Heuristic match: "history.museum" Heuristic match: "meteorapp.com" Heuristic match: "naka.hiroshima.jp" Heuristic match: "kamimine.saga.jp" Heuristic match: "rishiri.hokkaido.jp" Heuristic match: "shinjo.nara.jp" Heuristic match: "nesset.no" Heuristic match: "lib.ga.us" Heuristic match: "is-a-bookkeeper.com" Heuristic match: "samara.ru" Heuristic match: "ainan.ehime.jp" Heuristic match: "fujisawa.iwate.jp" Heuristic match: "hamatonbetsu.hokkaido.jp" Heuristic match: "my.eu.org" Heuristic match: "juedisches.museum" Heuristic match: "a.prod.fastly.net" Heuristic match: "norddal.no" Heuristic match: "geisei.kochi.jp" Heuristic match: "kasaoka.okayama.jp" Heuristic match: "bergen.no" Heuristic match: "kujukuri.chiba.jp" Heuristic match: "ochi.kochi.jp" Heuristic match: "okayama.jp" Heuristic match: "takahama.aichi.jp" Heuristic match: "shimofusa.chiba.jp" Heuristic match: "imakane.hokkaido.jp" Heuristic match: "shioya.tochigi.jp" Heuristic match: "culturalcenter.museum" Heuristic match: "is-a-llama.com" Heuristic match: "skanland.no" Heuristic match: "inagi.tokyo.jp" Heuristic match: "mobara.chiba.jp" Heuristic match: "historisch.museum" Heuristic match: "press.aero" Heuristic match: "barreau.bj" Heuristic match: "asaka.saitama.jp" Heuristic match: "birkenes.no" Heuristic match: "evje-og-hornnes.no" Heuristic match: "pomorze.pl" Heuristic match: "est-a-la-maison.com" Heuristic match: "paris.eu.org" Heuristic match: "withgoogle.com" Heuristic match: "ikawa.akita.jp" Heuristic match: "midori.gunma.jp" Heuristic match: "kazo.saitama.jp" Heuristic match: "komatsushima.tokushima.jp" Heuristic match: "mihara.kochi.jp" Heuristic match: "aridagawa.wakayama.jp" Heuristic match: "transport.museum" Heuristic match: "sodegaura.chiba.jp" Heuristic match: "edunet.tn" Heuristic match: "lib.md.us" Heuristic match: "kawakita.ishikawa.jp" Heuristic match: "act.edu.au" Heuristic match: "kurgan.ru" Heuristic match: "s3-us-gov-west-1.amazonaws.com" Heuristic match: "yashiro.hyogo.jp" Heuristic match: "alabama.museum" Heuristic match: "pasadena.museum" Heuristic match: "gs.svalbard.no" Heuristic match: "ap-northeast-2.compute.amazonaws.com" Heuristic match: "sakai.fukui.jp" Heuristic match: "miyama.fukuoka.jp" Heuristic match: "memorial.museum" Heuristic match: "nl.eu.org" Heuristic match: "us-west-2.compute.amazonaws.com" Heuristic match: "toya.hokkaido.jp" Heuristic match: "suldal.no" Heuristic match: "kurgan.su" Heuristic match: "enebakk.no" Heuristic match: "groks-the.info" Heuristic match: "anthropology.museum" Heuristic match: "baghdad.museum" Heuristic match: "kafjord.no" Heuristic match: "ueno.gunma.jp" Heuristic match: "vinnytsia.ua" Heuristic match: "misato.saitama.jp" Heuristic match: "torahime.shiga.jp" Heuristic match: "ichikai.tochigi.jp" Heuristic match: "katori.chiba.jp" Heuristic match: "shikama.miyagi.jp" Heuristic match: "vestnes.no" Heuristic match: "taiki.hokkaido.jp" Heuristic match: "nyc.museum" Heuristic match: "from-fl.com" Heuristic match: "varese.it" Heuristic match: "isumi.chiba.jp" Heuristic match: "a.ssl.fastly.net" Heuristic match: "imari.saga.jp" Heuristic match: "hiji.oita.jp" Heuristic match: "goto.nagasaki.jp" Heuristic match: "freebox-os.fr" Heuristic match: "yamazoe.nara.jp" Heuristic match: "nesoddtangen.no" Heuristic match: "amakusa.kumamoto.jp" Heuristic match: "ryazan.ru" Heuristic match: "arai.shizuoka.jp" Heuristic match: "donostia.museum" Heuristic match: "shibecha.hokkaido.jp" Heuristic match: "cody.museum" Heuristic match: "palace.museum" Heuristic match: "topology.museum" Heuristic match: "serveftp.com" Heuristic match: "academy.museum" Heuristic match: "nakatsugawa.gifu.jp" Heuristic match: "eigersund.no" Heuristic match: "ng.eu.org" Heuristic match: "shacknet.nu" Heuristic match: "tr.eu.org" Heuristic match: "*.ext.githubcloud.com" Heuristic match: "bihoro.hokkaido.jp" Heuristic match: "potager.org" Heuristic match: "reggio-emilia.it" Heuristic match: "mg.leg.br" Heuristic match: "kawagoe.saitama.jp" Heuristic match: "us-2.evennode.com" Heuristic match: "is-saved.org" Heuristic match: "shinanomachi.nagano.jp" Heuristic match: "artcenter.museum" Heuristic match: "komforb.se" Heuristic match: "whaling.museum" Heuristic match: "sannan.hyogo.jp" Heuristic match: "ambulance.museum" Heuristic match: "kanra.gunma.jp" Heuristic match: "kokubunji.tokyo.jp" Heuristic match: "nfshost.com" Heuristic match: "kushiro.hokkaido.jp" Heuristic match: "from-pa.com" Heuristic match: "voronezh.ru" Heuristic match: "kaneyama.yamagata.jp" Heuristic match: "meraker.no" Heuristic match: "gs.oslo.no" Heuristic match: "aoki.nagano.jp" Heuristic match: "ikoma.nara.jp" Heuristic match: "joyo.kyoto.jp" Heuristic match: "newyork.museum" Heuristic match: "is-a-hard-worker.com" Heuristic match: "samegawa.fukushima.jp" Heuristic match: "narvik.no" Heuristic match: "lib.ar.us" Heuristic match: "flekkefjord.no" Heuristic match: "ketrzyn.pl" Heuristic match: "hitoyoshi.kumamoto.jp" Heuristic match: "tabayama.yamanashi.jp" Heuristic match: "us-1.evennode.com" Heuristic match: "kumejima.okinawa.jp" Heuristic match: "from-co.net" Heuristic match: "bilbao.museum" Heuristic match: "kashima.ibaraki.jp" Heuristic match: "agrinet.tn" Heuristic match: "settsu.osaka.jp" Heuristic match: "bus.museum" Heuristic match: "ylandet.no" Heuristic match: "kawanehon.shizuoka.jp" Heuristic match: "firenze.it" Heuristic match: "murakami.niigata.jp" Heuristic match: "nord-aurdal.no" Heuristic match: "yachimata.chiba.jp" Heuristic match: "elb.amazonaws.com" Heuristic match: "istmein.de" Heuristic match: "itano.tokushima.jp" Heuristic match: "yamada.iwate.jp" Heuristic match: "tawaramoto.nara.jp" Heuristic match: "balsfjord.no" Heuristic match: "beskidy.pl" Heuristic match: "shingo.aomori.jp" Heuristic match: "ouda.nara.jp" Heuristic match: "servemp3.com" Heuristic match: "axis.museum" Heuristic match: "sor-aurdal.no" Heuristic match: "aosta-valley.it" Heuristic match: "fujiidera.osaka.jp" Heuristic match: "pescara.it" Heuristic match: "hiranai.aomori.jp" Heuristic match: "sagamihara.kanagawa.jp" Heuristic match: "gjemnes.no" Heuristic match: "asakuchi.okayama.jp" Heuristic match: "heritage.museum" Heuristic match: "venezia.it" Heuristic match: "oguni.yamagata.jp" Heuristic match: "kobayashi.miyazaki.jp" Heuristic match: "kagawa.jp" Heuristic match: "nango.fukushima.jp" Heuristic match: "bill.museum" Heuristic match: "culture.museum" Heuristic match: "nissedal.no" Heuristic match: "bajddar.no" Heuristic match: "journal.aero" Heuristic match: "evenassi.no" Heuristic match: "katano.osaka.jp" Heuristic match: "kosaka.akita.jp" Heuristic match: "s3-ap-southeast-2.amazonaws.com" Heuristic match: "tome.miyagi.jp" Heuristic match: "higashiyodogawa.osaka.jp" Heuristic match: "on-the-web.tv" Heuristic match: "omachi.nagano.jp" Heuristic match: "katowice.pl" Heuristic match: "lib.hi.us" Heuristic match: "isa-hockeynut.com" Heuristic match: "savannahga.museum" Heuristic match: "kashima.kumamoto.jp" Heuristic match: "is-a-chef.org" Heuristic match: "kainan.wakayama.jp" Heuristic match: "yamada.fukuoka.jp" Heuristic match: "oseto.nagasaki.jp" Heuristic match: "coastaldefence.museum" Heuristic match: "kadogawa.miyazaki.jp" Heuristic match: "mielec.pl" Heuristic match: "katashina.gunma.jp" Heuristic match: "sortland.no" Heuristic match: "indiana.museum" Heuristic match: "seika.kyoto.jp" Heuristic match: "workshop.museum" Heuristic match: "linz.museum" Heuristic match: "joetsu.niigata.jp" Heuristic match: "shingu.fukuoka.jp" Heuristic match: "miyama.mie.jp" Heuristic match: "yoita.niigata.jp" Heuristic match: "sicily.it" Heuristic match: "miyazaki.jp" Heuristic match: "kawazu.shizuoka.jp" Heuristic match: "ic.gov.pl" Heuristic match: "tondabayashi.osaka.jp" Heuristic match: "astronomy.museum" Heuristic match: "suginami.tokyo.jp" Heuristic match: "kariya.aichi.jp" Heuristic match: "usgarden.museum" Heuristic match: "fujinomiya.shizuoka.jp" Heuristic match: "isa.kagoshima.jp" Heuristic match: "muenster.museum" Heuristic match: "mashike.hokkaido.jp" Heuristic match: "!city.kawasaki.jp" Heuristic match: "townnews-staging.com" Heuristic match: "novosibirsk.ru" Heuristic match: "kunisaki.oita.jp" Heuristic match: "from-sd.com" Heuristic match: "nikolaev.ua" Heuristic match: "is-a-chef.com" Heuristic match: "rikuzentakata.iwate.jp" Heuristic match: "shinyoshitomi.fukuoka.jp" Heuristic match: "zhytomyr.ua" Heuristic match: "cloudns.asia" Heuristic match: "urausu.hokkaido.jp" Heuristic match: "ee.eu.org" Heuristic match: "nanae.hokkaido.jp" Heuristic match: "pilots.museum" Heuristic match: "zakopane.pl" Heuristic match: "minato.tokyo.jp" Heuristic match: "database.museum" Heuristic match: "ohkura.yamagata.jp" Heuristic match: "jessheim.no" Heuristic match: "tamayu.shimane.jp" Heuristic match: "ivano-frankivsk.ua" Heuristic match: "eu.meteorapp.com" Heuristic match: "cable-modem.org" Heuristic match: "muika.niigata.jp" Heuristic match: "kami.kochi.jp" Heuristic match: "leangaviika.no" Heuristic match: "uk.eu.org" Heuristic match: "nakamichi.yamanashi.jp" Heuristic match: "kiyosu.aichi.jp" Heuristic match: "karatsu.saga.jp" Heuristic match: "nishio.aichi.jp" Heuristic match: "sirdal.no" Heuristic match: "k12.or.us" Heuristic match: "minokamo.gifu.jp" Heuristic match: "from-ky.com" Heuristic match: "freeboxos.fr" Heuristic match: "mining.museum" Heuristic match: "vevelstad.no" Heuristic match: "family.museum" Heuristic match: "int.eu.org" Heuristic match: "lavagis.no" Heuristic match: "kawai.iwate.jp" Heuristic match: "klodzko.pl" Heuristic match: "saigawa.fukuoka.jp" Heuristic match: "kawatana.nagasaki.jp" Heuristic match: "on-aptible.com" Heuristic match: "s3-fips-us-gov-west-1.amazonaws.com" Heuristic match: "tanabe.kyoto.jp" Heuristic match: "winb.gov.pl" Heuristic match: "higashiizu.shizuoka.jp" Heuristic match: "larsson.museum" Heuristic match: "lib.sc.us" Heuristic match: "lib.nj.us" Heuristic match: "hapmir.no" Heuristic match: "lib.gu.us" Heuristic match: "is-a-rockstar.com" Heuristic match: "carraramassa.it" Heuristic match: "oiso.kanagawa.jp" Heuristic match: "verbania.it" Heuristic match: "kamigori.hyogo.jp" Heuristic match: "yamatsuri.fukushima.jp" Heuristic match: "pharmaciens.km" Heuristic match: "portland.museum" Heuristic match: "michigan.museum" Heuristic match: "is-a-linux-user.org" Heuristic match: "couchpotatofries.org" Heuristic match: "kumenan.okayama.jp" Heuristic match: "aomori.jp" Heuristic match: "minamiashigara.kanagawa.jp" Heuristic match: "kasai.hyogo.jp" Heuristic match: "ski.museum" Heuristic match: "elvendrell.museum" Heuristic match: "tingvoll.no" Heuristic match: "matsusaka.mie.jp" Heuristic match: "tonsberg.no" Heuristic match: "namie.fukushima.jp" Heuristic match: "bounty-full.com" Heuristic match: "southcarolina.museum" Heuristic match: "media.aero" Heuristic match: "bjarkoy.no" Heuristic match: "folldal.no" Heuristic match: "daejeon.kr" Heuristic match: "myfritz.net" Heuristic match: "okazaki.aichi.jp" Heuristic match: "urbino-pesaro.it" Heuristic match: "shijonawate.osaka.jp" Heuristic match: "saitama.saitama.jp" Heuristic match: "magazine.aero" Heuristic match: "duckdns.org" Heuristic match: "choshi.chiba.jp" Heuristic match: "mosvik.no" Heuristic match: "mashiki.kumamoto.jp" Heuristic match: "lib.nh.us" Heuristic match: "azurewebsites.net" Heuristic match: "schlesisches.museum" Heuristic match: "uw.gov.pl" Heuristic match: "odawara.kanagawa.jp" Heuristic match: "sande.more-og-romsdal.no" Heuristic match: "higashihiroshima.hiroshima.jp" Heuristic match: "yoshikawa.saitama.jp" Heuristic match: "humanities.museum" Heuristic match: "plc.co.im" Heuristic match: "design.museum" Heuristic match: "ono.hyogo.jp" Heuristic match: "oregontrail.museum" Heuristic match: "takayama.gunma.jp" Heuristic match: "ebina.kanagawa.jp" Heuristic match: "kawachinagano.osaka.jp" Heuristic match: "gotpantheon.com" Heuristic match: "takata.fukuoka.jp" Heuristic match: "tarama.okinawa.jp" Heuristic match: "kisarazu.chiba.jp" Heuristic match: "marylhurst.museum" Heuristic match: "from-ia.com" Heuristic match: "piedmont.it" Heuristic match: "goshiki.hyogo.jp" Heuristic match: "mizusawa.iwate.jp" Heuristic match: "sandoy.no" Heuristic match: "atlanta.museum" Heuristic match: "imperia.it" Heuristic match: "is-very-sweet.org" Heuristic match: "naka.ibaraki.jp" Heuristic match: "giessen.museum" Heuristic match: "vic.edu.au" Heuristic match: "sa-east-1.compute.amazonaws.com" Heuristic match: "hakui.ishikawa.jp" Heuristic match: "chikujo.fukuoka.jp" Heuristic match: "okuizumo.shimane.jp" Heuristic match: "kota.aichi.jp" Heuristic match: "kids.museum" Heuristic match: "fukagawa.hokkaido.jp" Heuristic match: "sdn.gov.pl" Heuristic match: "makinohara.shizuoka.jp" Heuristic match: "nishikata.tochigi.jp" Heuristic match: "numata.hokkaido.jp" Pattern match: "yyyyd.M.yydd/MM/yyyydddd" Heuristic match: "ttesa.kI" Heuristic match: ".info"29:T9c9,"---------------------------------------------- ALL YOUR FILES ARE ENCRYPTED ----------------------------------------------- Your unique ID:5FD5736C Hello! All your files documents, photos, databases and other files are encrypted with strongest encryption" (Source: 00087118-00004852-00000005-6000594938, Indicator: "files are encrypted") "---------------------------------------------- ALL YOUR FILES ARE ENCRYPTED ----------------------------------------------- Your unique ID:5FD5736C Hello! All your files documents, photos, databases and other files are encrypted with strongest encryption! Dont worry, you can return all your files! To receive the decryption tool contact us and tell us your unique ID If you want your files You have to pay for decryption in Bitcoins The price depends on how fast you write to us. ======================================================================================================================================== Free decryption as guarantee! Send me your unique ID and 1-2 small encrypted files The total size of files must be less than 10Mb non archived for free decryption. After payment we will send you the decryption tool that will decrypt all your files. ======================================================================================================================================== You can buy bitcoin from here: https://localbitcoins.com/buy_bitcoins https://www.coinmama.com/bitcoin https://www.coinbase.com/buy-bitcoin ======================================================================================================================================== CAUTION! 1-Don't try to use third-party decrypt tools because it will destroy your files. 2-Please do not change the name of files or file extension if your files are important to you! ======================================================================================================================================== If you want return all of your files write on our e-mail: Computer.Repair.Technician@protonmail.com" (Source: How to recover your files.txt, Indicator: "files are encrypted") "---------------------------------------------- ALL YOUR FILES ARE ENCRYPTED -----------------------------------------------" (Source: How to recover your files.txt, Indicator: "files are encrypted") "All your files documents, photos, databases and other files are encrypted with strongest encryption!" (Source: How to recover your files.txt, Indicator: "files are encrypted")2a:T637,"C:\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe" marked "C:\Users\%OSUSER%\How to recover your files.txt" for deletion "C:\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe" marked "C:\Users\%OSUSER%\Favorites\How to recover your files.txt" for deletion "C:\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe" marked "C:\Users\%OSUSER%\Links\How to recover your files.txt" for deletion "C:\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe" marked "C:\Users\%OSUSER%\Contacts\How to recover your files.txt" for deletion "C:\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe" marked "C:\Users\%OSUSER%\Documents\Outlook Files\How to recover your files.txt" for deletion "C:\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe" marked "C:\Users\%OSUSER%\Downloads\How to recover your files.txt" for deletion "C:\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe" marked "C:\Users\%OSUSER%\Favorites\Links for United States\How to recover your files.txt" for deletion "C:\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe" marked "C:\Users\%OSUSER%\Favorites\Microsoft Websites\How to recover your files.txt" for deletion "C:\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe" marked "C:\Users\%OSUSER%\Pictures\How to recover your files.txt" for deletion "C:\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe" marked "C:\Users\%OSUSER%\Saved Games\How to recover your files.txt" for deletion2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790439745615,"unified_at":"2026-09-26T16:22:25.615Z","metadata":{"hashes":{"sha256":"2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a","sha1":"235415861f9b9be9e2413fc5c2ce8d34122a2f76","md5":"984db2d337c7a1f8c7eee662382d5354","sha512":"441987dbcf8abb7715214dd06b60d26ac52d6e718f6ca4cecb6b93bfa5a89277bc1efb284e85a50be25c952d58e9227b567c56c54e2314541594a9300f55ce9a","ssdeep":"49152:PauNfoQyN+/0wiZS1ypgZ0Jsv6tWKFdu9CavFVPAz7vvTHy7aCT0AaasQLlRtgqX:BAJY0VOcguJsv6tWKFdu9Ca7Uaa","ssdeep_chunks":["49152:PauNfoQ","49152:auNfoQy","49152:uNfoQyN","49152:NfoQyN+","49152:foQyN+/","49152:oQyN+/0","49152:QyN+/0w","49152:yN+/0wi","49152:N+/0wiZ","49152:+/0wiZS","49152:/0wiZS1","49152:0wiZS1y","49152:wiZS1yp","49152:iZS1ypg","49152:ZS1ypgZ","49152:S1ypgZ0","49152:1ypgZ0J","49152:ypgZ0Js","49152:pgZ0Jsv","49152:gZ0Jsv6","49152:Z0Jsv6t","49152:0Jsv6tW","49152:Jsv6tWK","49152:sv6tWKF","49152:v6tWKFd","49152:6tWKFdu","49152:tWKFdu9","49152:WKFdu9C","49152:KFdu9Ca","49152:Fdu9Cav","49152:du9CavF","49152:u9CavFV","49152:9CavFVP","49152:CavFVPA","49152:avFVPAz","49152:vFVPAz7","49152:FVPAz7v","49152:VPAz7vv","49152:PAz7vvT","49152:Az7vvTH","49152:z7vvTHy","49152:7vvTHy7","49152:vvTHy7a","49152:vTHy7aC","49152:THy7aCT","49152:Hy7aCT0","49152:y7aCT0A","49152:7aCT0Aa","49152:aCT0Aaa","49152:CT0Aaas","49152:T0AaasQ","49152:0AaasQL","49152:AaasQLl","49152:aasQLlR","49152:asQLlRt","49152:sQLlRtg","49152:QLlRtgq","49152:LlRtgqX","98304:PauNfoQ","98304:auNfoQy","98304:uNfoQyN","98304:NfoQyN+","98304:foQyN+/","98304:oQyN+/0","98304:QyN+/0w","98304:yN+/0wi","98304:N+/0wiZ","98304:+/0wiZS","98304:/0wiZS1","98304:0wiZS1y","98304:wiZS1yp","98304:iZS1ypg","98304:ZS1ypgZ","98304:S1ypgZ0","98304:1ypgZ0J","98304:ypgZ0Js","98304:pgZ0Jsv","98304:gZ0Jsv6","98304:Z0Jsv6t","98304:0Jsv6tW","98304:Jsv6tWK","98304:sv6tWKF","98304:v6tWKFd","98304:6tWKFdu","98304:tWKFdu9","98304:WKFdu9C","98304:KFdu9Ca","98304:Fdu9Cav","98304:du9CavF","98304:u9CavFV","98304:9CavFVP","98304:CavFVPA","98304:avFVPAz","98304:vFVPAz7","98304:FVPAz7v","98304:VPAz7vv","98304:PAz7vvT","98304:Az7vvTH","98304:z7vvTHy","98304:7vvTHy7","98304:vvTHy7a","98304:vTHy7aC","98304:THy7aCT","98304:Hy7aCT0","98304:y7aCT0A","98304:7aCT0Aa","98304:aCT0Aaa","98304:CT0Aaas","98304:T0AaasQ","98304:0AaasQL","98304:AaasQLl","98304:aasQLlR","98304:asQLlRt","98304:sQLlRtg","98304:QLlRtgq","98304:LlRtgqX","49152:BAJY0VO","49152:AJY0VOc","49152:JY0VOcg","49152:Y0VOcgu","49152:0VOcguJ","49152:VOcguJs","49152:OcguJsv","49152:cguJsv6","49152:guJsv6t","49152:uJsv6tW","49152:Fdu9Ca7","49152:du9Ca7U","49152:u9Ca7Ua","49152:9Ca7Uaa"],"imphash":"b08bd0b468d5a47d0224db535aa0c9c2"},"file_info":{"file_name":"System.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2945024,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1556556977000,"last_seen":1677362754000,"last_multi_scan":1677362754000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":14,"suspicious_count":11,"malicious_count":3,"total":28},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Gen.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Occamy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1210444","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Stop.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Stop.2 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.NUB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00547cb31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.fpqszv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FJG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Stop.2945024","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.9240","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Stop.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00098225-00001952-15552-90-00AFC1C7","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 18922-16262-00496DB0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00098225-00001952-15552-22-00AF2306","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 18922-16152-004F63B0\n GetTimeZoneInformation@KERNEL32.dll at 18922-16226-00513E8C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 00513FB8h\" at 18922-16226-00513E8C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\\" at 00098225-00001952-0000010C-4215313625\n \".exe\" queries volume information of \"C:\\\" at 00098225-00001952-0000010C-4225347551","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00098225-00001952-0000010C-4215313625\n \".exe\" queries volume information of \"C:\\\" at 00098225-00001952-0000010C-4225347551","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Shortcut\" (Path: \"HKCU\\CLSID\\{00021401-0000-0000-C000-000000000046}\")\n \".exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")\n \".exe\" touched \"UsersFiles\" (Path: \"HKCU\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")\n \".exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")\n \".exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\INPROCSERVER32\")\n \".exe\" touched \"Shell File System Folder\" (Path: \"HKCU\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\INPROCSERVER32\")\n \".exe\" touched \"Recent Places Folder\" (Path: \"HKCU\\CLSID\\{22877A6D-37A1-461A-91B0-DBDA5AAEBC99}\\SHELLFOLDER\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"[InternetShortcut]\nIDList=\nURL=https://www.youtube.com/watch?v=xKIIFlqz4sI/\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"America/New_York America/Detroit America/Indiana/Petersburg America/Indiana/Vincennes America/Indiana/Winamac America/Kentucky/Monticello America/Louisville\" (Indicator: \"ntice\")","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00098225-00001952-15552-341-00AF1EF5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\".exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \".!.#.%.'.).+.-./.1.3.5.7.9.;.=.?.A.C.E.G.I.K.M.O.Q.S.U.W.Y.[.]._.a.c.e.g.i.k.m.\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\bg.png\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegEnumKeyExW\n RegOpenKeyExW\n RegDeleteKeyW\n FindFirstFileW\n GetFileAttributesW\n GetTempPathW\n ConnectNamedPipe\n OutputDebugStringW\n DeviceIoControl\n CopyFileW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n CreateThread\n ExitThread\n WriteFileEx\n TerminateProcess\n GetModuleHandleExW\n SleepEx\n LoadLibraryW\n LoadLibraryA\n OpenProcess\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n CreateFileMappingW\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n FindFirstFileExW\n GetProcAddress\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetTickCount64\n UnhandledExceptionFilter\n MapViewOfFile\n GetModuleHandleW\n GetFileAttributesExW\n WriteFile\n CreateProcessW\n Sleep\n GetWindowThreadProcessId\n SetWindowsHookExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c04eba772054bb77e065bb77b538bc770000000000d0d77600000000c5ead7760000000088ead77600000000e968ad758228bc77ee29bc7700000000d269ad75000000007dbbd7760000000009bead7500000000ba18d77600000000\" to virtual address \"0x77CC1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.bin\" (Offset: 131736)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"33/70 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"33/70 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"How to recover your files.txt\" has type \"ASCII text with CRLF line terminators\"\n \"How to recover your files.url\" has type \"MS Windows 95 Internet shortcut text (URL=) ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$29","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2a","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":41,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":61,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["User Comment","Extracted Files"],"sandbox_reports":[{"id":"5cc9f9be0288384251cc8639","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.Stop","submit_name":"System.exe","analysis_start_time":"2019-05-01T19:55:43+00:00","indicators_count":{"informative":13,"suspicious":12,"malicious":4},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"5cc72cbc0388381b0eb96af7","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.Stop","submit_name":"2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a","analysis_start_time":"2019-04-29T16:56:30+00:00","indicators_count":{"informative":14,"suspicious":13,"malicious":4},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"}],"processes":[{"pid":1952,"ppid":0,"name":"2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe","command_line":"","sha256":"2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a","normalized_path":"C:\\2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a.exe","uid":"00098225-00001952","icon":"$2b"}],"all_imported_dlls":["imm32.dll","lpk.dll","rpcrt4.dll","api-ms-win-core-synch-l1-2-0.dll","comctl32.dll","propsys.dll","Wldap32.dll","gdi32.dll","advapi32.dll","sechost.dll","winmm.dll","oleaut32.dll","uxtheme.dll","apphelp.dll","ntdll.dll","kernel32.dll","KernelBase.dll","msvcrt.dll","msctf.dll","devobj.dll","ole32.dll","ws2_32.dll","shell32.dll","clbcatq.dll","linkinfo.dll","cryptbase.dll","setupapi.dll","user32.dll","usp10.dll","shlwapi.dll","profapi.dll","nsi.dll","userenv.dll","rpcss.dll","cfgmgr32.dll","ntmarta.dll","shdocvw.dll","wow64win.dll","wow64.dll","sspicli.dll","wow64cpu.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"How to recover your files.txt","sha256":"06c62f813879e96d15ba0ec5d66980f1a4554613c24fd03d49907fa70960aee7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"name":"How to recover your files.url","sha256":"510e2c4af15563de12377d00732284e569576e58f139d1656b86af2c59e5cf4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]}],"files_written":[{"path":"C:\\Qt\\Qt5.8.0\\5.8\\static\\qtlogging.ini","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Links\\Desktop.lnk","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Links\\Downloads.lnk","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Links\\OneDrive.lnk","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Links\\RecentPlaces.lnk","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc9f9be0288384251cc8639"},{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Contacts\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Downloads\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Favorites\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Links\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Pictures\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%USERPROFILE%\\Saved Games\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\Documents\\How to recover your files.txt","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\Documents\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\How to recover your files.txt","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\Pictures\\How to recover your files.txt","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\Pictures\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\How to recover your files.txt","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\Videos\\How to recover your files.txt","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"%PUBLIC%\\Videos\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"C:\\How to recover your files.txt","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"C:\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"C:\\PerfLogs\\How to recover your files.txt","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]},{"path":"C:\\PerfLogs\\How to recover your files.url","sources":[{"report_type":"sandbox","report_id":"5cc72cbc0388381b0eb96af7"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5cc9f9be0288384251cc8639","5cc72cbc0388381b0eb96af7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Stop.Generic Sample 2fec3892efa6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2fec3892efa6…. Malware family: Ransom.Stop.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Stop.Generic Sample 2fec3892efa6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2fec3892efa6…. Malware family: Ransom.Stop.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2fec3892efa6ad300ff1d5334875d94e0470bf1b4e71449b10221f790f5f2d3a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Stop.Generic Sample 2fec3892efa6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2fec3892efa6…. Malware family: Ransom.Stop.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]