24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.MedusaLocker Sample 49da42d00cc3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 49da42d00cc3…. Malware family: Trojan.Ransom.MedusaLocker. Threat score 100/100. 18/28 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/49da42d00cc3ad6379ead2e07fd5f09bd358b144a6e78aad4bb1a8298e2bb568","keywords":["Malicious","Trojan.Ransom.MedusaLocker","malware analysis","sandbox report","threat intelligence","49da42d00cc3ad6379ead2e07fd5f09bd358b144a6e78aad4bb1a8298e2bb568"],"about":{"@type":"SoftwareApplication","name":"dix_16.exe","applicationCategory":["peexe","executable"],"identifier":"49da42d00cc3ad6379ead2e07fd5f09bd358b144a6e78aad4bb1a8298e2bb568","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.MedusaLocker","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tae3,"b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "\Device\HarddiskVolume1\Boot\BCD" at 00074210-00002124-00000046-11407531 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\el-GR" at 00074210-00002124-00000046-11842294 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\el-GR" at 00074210-00002124-00000046-12214726 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\el-GR" at 00074210-00002124-00000046-12298577 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\el-GR" at 00074210-00002124-00000046-12383053 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml" at 00074210-00002124-00000046-12479636 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\ko-KR\bootmgr.exe.mui" at 00074210-00002124-00000046-12608602 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\ko-KR\bootmgr.exe.mui" at 00074210-00002124-00000046-12708652 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\ko-KR\bootmgr.exe.mui" at 00074210-00002124-00000046-12794022 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\Fonts\jpn_boot.ttf" at 00074210-00002124-00000046-12881254 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\Fonts\jpn_boot.ttf" at 00074210-00002124-00000046-13075604 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\Fonts\jpn_boot.ttf" at 00074210-00002124-00000046-13150244 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\Fonts\jpn_boot.ttf" at 00074210-00002124-00000046-13265399 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\Fonts\cht_boot.ttf" at 00074210-00002124-00000046-13325128 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\Fonts\jpn_boot.ttf" at 00074210-00002124-00000046-13388951 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\Fonts\kor_boot.ttf" at 00074210-00002124-00000046-13463510 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\ko-KR\bootmgr.exe.mui" at 00074210-00002124-00000046-13535703 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\ko-KR\bootmgr.exe.mui" at 00074210-00002124-00000046-13609088 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\ko-KR\bootmgr.exe.mui" at 00074210-00002124-00000046-13673004 "b58e151f956d6249f160ac8f47c7bd10.exe" queries volume information of "Y:\Boot\ko-KR\bootmgr.exe.mui" at 00074210-00002124-00000046-1374263426:T430,"b58e151f956d6249f160ac8f47c7bd10.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "b58e151f956d6249f160ac8f47c7bd10.exe" touched "Copy/Move/Rename/Delete/Link Object" (Path: "HKCU\WOW6432NODE\CLSID\{3AD05575-8857-4850-9277-11B85BDB8E09}") "b58e151f956d6249f160ac8f47c7bd10.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "b58e151f956d6249f160ac8f47c7bd10.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DEFAULTICON") "vssadmin.exe" touched "VSSCoordinator Class" (Path: "HKCU\WOW6432NODE\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}") "vssadmin.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}") "WMIC.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "WMIC.exe" touched "Free Threaded XML DOM Document" (Path: "HKCU\WOW6432NODE\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}")27:T69f,"b58e151f956d6249f160ac8f47c7bd10.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "C:\Windows\SysWOW64\tzres.dll" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "C:\Windows\SysWOW64\vssadmin.exe" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "C:\Windows\SysWOW64\wbem\WMIC.exe" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "C:\Windows\SysWOW64\net.exe" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "b58e151f956d6249f160ac8f47c7bd10.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "vssadmin.exe" touched file "C:\Windows\SysWOW64\en-US\vssadmin.exe.mui" "vssadmin.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "vssadmin.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "vssadmin.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui"28:T8aa,"b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3507206 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3518573 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3528839 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3539130 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3552254 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3562825 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3572766 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3583060 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3593278 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3605328 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3615601 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3625794 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3635647 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3645764 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3656212 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3666397 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3677019 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3693220 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-3706551 "b58e151f956d6249f160ac8f47c7bd10.exe" queried SystemProcessInformation at 00074210-00002124-00000033-371694529:T473,"t: auto; padding-right: 50px; line-height: 1.5; } .text div { padding: 0 15px; } .footer { background: none; } }

All your data are encrypted!

What happened?
Your files are encrypted, and currently unavailable.
You can check it: all files on you computer has new expansion.
By the way, everything is possible to recover (restore), but you need to buy a unique decryptor.
Otherwise, you never cant return your data.

For purchasing a decryptor contact us by email:
mrromber@cock.li
If you will get no answer within 24 hours contact us by our alternate emails: