26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4c3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.GlobeImposter.Generic Sample 5b2045f86626… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5b2045f86626…. Malware family: Ransom.GlobeImposter.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85","keywords":["Malicious","Ransom.GlobeImposter.Generic","malware analysis","sandbox report","threat intelligence","5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85"],"about":{"@type":"SoftwareApplication","name":"helper666_up.exe","applicationCategory":["peexe","executable"],"identifier":"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.GlobeImposter.Generic","antivirusDetections":{"malicious":21,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5aa,".exe" read file "C:\Users\desktop.ini" ".exe" read file "C:\Users\Public\desktop.ini" ".exe" read file "C:\Users\Public\Videos\desktop.ini" ".exe" read file "C:\Users\Public\Videos\Sample Videos\desktop.ini" ".exe" read file "C:\Users\Public\Recorded TV\desktop.ini" ".exe" read file "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" ".exe" read file "C:\Users\Public\Pictures\desktop.ini" ".exe" read file "C:\Users\Public\Pictures\Sample Pictures\desktop.ini" ".exe" read file "C:\Users\Public\Music\desktop.ini" ".exe" read file "C:\Users\Public\Music\Sample Music\desktop.ini" ".exe" read file "C:\Users\Public\Libraries\desktop.ini" ".exe" read file "C:\Users\Public\Downloads\desktop.ini" ".exe" read file "C:\Users\Public\Desktop\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\ntuser.ini" ".exe" read file "C:\Users\Public\Documents\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\Searches\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\Saved Games\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\Pictures\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\Videos\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\OneDrive\desktop.ini"28:T7cd,".exe" opened "C:\Users\desktop.ini" with delete access ".exe" opened "C:\Users\Public\desktop.ini" with delete access ".exe" opened "C:\Users\Public\Videos\desktop.ini" with delete access ".exe" opened "C:\Users\Public\Videos\Sample Videos\desktop.ini" with delete access ".exe" opened "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv" with delete access ".exe" opened "C:\Users\Public\Recorded TV\desktop.ini" with delete access ".exe" opened "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" with delete access ".exe" opened "C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access ".exe" opened "C:\Users\Public\Pictures\desktop.ini" with delete access ".exe" opened "C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access ".exe" opened "C:\Users\Public\Pictures\Sample Pictures\Desert.jpg" with delete access ".exe" opened "C:\Users\Public\Pictures\Sample Pictures\desktop.ini" with delete access ".exe" opened "C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access ".exe" opened "C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg" with delete access ".exe" opened "C:\Users\Public\Pictures\Sample Pictures\Koala.jpg" with delete access ".exe" opened "C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg" with delete access ".exe" opened "C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg" with delete access ".exe" opened "C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg" with delete access ".exe" opened "C:\Users\Public\Music\desktop.ini" with delete access ".exe" opened "C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg" with delete access29:T81a,Found dropped filename "cp860.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp862.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "ebcdic.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp1254.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp864.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp852.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp866.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "big5.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso2022-kr.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb1988.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macThai.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0212.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "koi8-u.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb12345.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp950.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp932.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp775.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp936.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp1253.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp1251.enc" which has been seen in the context of ransomware (Indicator: .ENC)2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790720254632,"unified_at":"2026-09-29T22:17:34.632Z","metadata":{"hashes":{"sha256":"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85","sha1":"7b73d7e39f0b427115c7abf101d62fe4c0d4f366","md5":"9aa7c9baa0cac74606b8aa234e4b8295","sha512":"1d3251ead52a1824877e0b883fd047287796d7b1157f65f73ac7ec75c996b1b129c2f7182a23fb60e106560b55ff81b7f3657adde0d8ccae7fff84f24e184c23","ssdeep":"3072:Key23alnaEIN/W6EJztAzxqBI8pVcxDN:SnaP/W75A9wpVcBN","ssdeep_chunks":["3072:Key23al","3072:ey23aln","3072:y23alna","3072:23alnaE","3072:3alnaEI","3072:alnaEIN","3072:lnaEIN/","3072:naEIN/W","3072:aEIN/W6","3072:EIN/W6E","3072:IN/W6EJ","3072:N/W6EJz","3072:/W6EJzt","3072:W6EJztA","3072:6EJztAz","3072:EJztAzx","3072:JztAzxq","3072:ztAzxqB","3072:tAzxqBI","3072:AzxqBI8","3072:zxqBI8p","3072:xqBI8pV","3072:qBI8pVc","3072:BI8pVcx","3072:I8pVcxD","3072:8pVcxDN","6144:Key23al","6144:ey23aln","6144:y23alna","6144:23alnaE","6144:3alnaEI","6144:alnaEIN","6144:lnaEIN/","6144:naEIN/W","6144:aEIN/W6","6144:EIN/W6E","6144:IN/W6EJ","6144:N/W6EJz","6144:/W6EJzt","6144:W6EJztA","6144:6EJztAz","6144:EJztAzx","6144:JztAzxq","6144:ztAzxqB","6144:tAzxqBI","6144:AzxqBI8","6144:zxqBI8p","6144:xqBI8pV","6144:qBI8pVc","6144:BI8pVcx","6144:I8pVcxD","6144:8pVcxDN","3072:SnaP/W7","3072:naP/W75","3072:aP/W75A","3072:P/W75A9","3072:/W75A9w","3072:W75A9wp","3072:75A9wpV","3072:5A9wpVc","3072:A9wpVcB","3072:9wpVcBN"],"imphash":"ba2ce247fa49357770ce28f139e2f1ab"},"file_info":{"file_name":"helper666_up.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":98816,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1566926655000,"last_seen":1646384762000,"last_multi_scan":1646384762000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","crypt","downloader","filecoder","pscrypt","ransomware"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":6,"suspicious_count":16,"malicious_count":6,"total":28},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.GlobeImposter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.GlobeImposter.3DDAB40C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Heur.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Necne.AB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-0a10191d!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.GlobeImposter.3DDAB40C (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.FV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.GlobeImposter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005031101 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Purgen.aom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Globelmposter!9AA7C9BAA0CA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.faecqn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Mauvaise.SL1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EVE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.80CDF774","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.80CDF774","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.RBV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.GlobeImposter.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/techniques/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/techniques/T1063","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]}],"sandbox_signatures":[{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"netyeHD3z7v.exe\" has type \"data\"\n \"603jOLdO.exe\" has type \"data\"\n \"CZspj.doc\" has type \"data\"\n \"5F7TBCLUxJG.doc\" has type \"data\"\n \"airappinstaller.exe\" has type \"data\"\n \"securitypack.jar\" has type \"data\"\n \"iynDCtAWKrZqk.exe\" has type \"data\"\n \"Desktop.lnk\" has type \"data\"\n \"uVLcWdEsjtuv46e.exe\" has type \"data\"\n \"Z2WBj58d55LDmYTY.exe\" has type \"data\"\n \"j8Sa.doc\" has type \"data\"\n \"3LnBJn.doc\" has type \"data\"\n \"qtaV9p.exe\" has type \"data\"\n \"oJIkHjK96.exe\" has type \"data\"\n \"xHkhUwrp.doc\" has type \"data\"\n \"tpnUorm2s9.doc\" has type \"data\"\n \"bMTL7.doc\" has type \"data\"\n \"4RHcGmkB.exe\" has type \"data\"\n \"2VEV49vrsTLgZa.doc\" has type \"data\"\n \"pJ5LdT.doc\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Microsoft.NET\"\n Pattern match: \"http://meyerweb.com/eric/tools/css/reset/\"\n Pattern match: \"http://meyerwe\"\n Pattern match: \"b.com/eric/tools\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"COMODO\" (Indicator: \"comodo\")\n \"Kaspersky Lab\" (Indicator: \"kaspersky\")\n \"McAfee\" (Indicator: \"mcafee\")\n \"Avira\" (Indicator: \"avira\")\n \"Avast\" (Indicator: \"avast\")\n \"Symantec\" (Indicator: \"symantec\")","origin":"File/Memory","mitre_attack_id":"T1063","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00185287-00000584-00000033-11198162939","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .rdata with unusual entropies 7.21265546622\n 7.21265546622","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"HAPUBWS.contact\" containing the Windows username \"HAPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"$27","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%LOCALAPPDATA%\\5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"Your files are encrypted!\" (Source: How_to_open_files.html, Indicator: \"files are encrypted\")\n \"Your files are encrypted, and currently unavailable.
\" (Source: How_to_open_files.html, Indicator: \"files are encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1060 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$28","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.bin\" has an entrypoint in section \".rdata\"\n \"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe\" has an entrypoint in section \".rdata\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n RegOpenKeyExW\n CopyFileW\n GetModuleFileNameW\n GetDriveTypeA\n GetFileAttributesW\n GetTempFileNameW\n GetFileSizeEx\n CreateThread\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n ShellExecuteExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"711118027a3b1702ab8b02007f950200fc8c0200729602006cc805001ecd14027d261402\" to virtual address \"0x751507E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\".exe\" created file \"%LOCALAPPDATA%\\5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"56/70 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"56/70 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"56/70 Antivirus vendors marked dropped file \"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe\" as malicious (classified as \"DeepScan:Generic.Ransom.GlobeImposter\" with 80% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\\5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"\"ntldr\"","origin":"File/Memory","relevance":9,"id":"string-0","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameW@SHLWAPI.DLL at 00035352-00002008-13714-33-00409C57\n PathFindFileNameW@SHLWAPI.DLL at 00035352-00002008-13714-118-004096D7","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00035352-00002008-13714-11-00402765\n GetProcessHeap@KERNEL32.DLL at 00035352-00002008-13714-14-0040274B\n GetProcessHeap@KERNEL32.DLL at 00035352-00002008-13714-60-0040278D\n GetProcessHeap@KERNEL32.DLL at 00035352-00002008-13714-58-00402779","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.39/32, 192.168.240.223/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"$29","origin":"Binary File","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":22,"dropped_files_count":0,"extracted_files_count":155,"files_written_count":97,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","crypt","downloader","filecoder","pscrypt","ransomware"],"sample_flags":["Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5d66ad1d0288384c4c4d3199","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DeepScan:Generic.Ransom.GlobeImposter","submit_name":"helper666_up.exe","analysis_start_time":"2019-08-28T16:31:55+00:00","indicators_count":{"informative":6,"suspicious":16,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5d65673e03883816855b1bd1","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DeepScan:Generic.Ransom.GlobeImposter","submit_name":"helper666_up.exe","analysis_start_time":"2019-08-29T20:24:05+00:00","indicators_count":{"informative":4,"suspicious":16,"malicious":7},"tags":["Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}],"processes":[{"pid":584,"ppid":0,"name":"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe","command_line":"","sha256":"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85","normalized_path":"C:\\5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe","uid":"00185287-00000584","icon":"$2a"}],"all_imported_dlls":["rsaenh.dll","wow64win.dll","rpcrt4.dll","msctf.dll","advapi32.dll","wow64.dll","sechost.dll","shell32.dll","shlwapi.dll","usp10.dll","cryptsp.dll","ntdll.dll","user32.dll","wow64cpu.dll","KernelBase.dll","msvcrt.dll","sspicli.dll","cryptbase.dll","imm32.dll","kernel32.dll","gdi32.dll","lpk.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe","sha256":"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"How_to_open_files.html","sha256":"2d7e672d526c5d9c9448537a889a0315727fbaa257b8973df53a24e5acacb577","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"InstallTime20171128222554","sha256":"f753fc6001c5a7267b0ff18c67c8c82e0370ccdb4c00e44899842602d01d714f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"SiteSecurityServiceState.txt","sha256":"98bda62d0c85fa7e785799f4165edf61bab17bd58689e24759bce270ef916c9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"addonStartup.json.lz4","sha256":"d3b1b77cef84001dc2868927ecd2f7ba0845a7f69452c0e11a4f116c1b0cd0a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"blocklist.xml","sha256":"a323a4b5d5742cae141b9deb7c9a6f9f5114638fbad16e3d3cb23f8613b2cc1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"addons.json","sha256":"8c8ae86c93bdfbb194dc0024af0ea4be0ee38abccd8017652185fca39dba6cf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"plugins.json","sha256":"3de2c0046fd3d95cbe083369a9bc76d87a0f09d9d2696fdbf0abe4b350e9ff13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"cert8.db","sha256":"1dc0595935609ad196c2e4b31f7abcfc251e57749ed2905a2b1077fac0ddbcb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"compatibility.ini","sha256":"e82b39ef86ffe21493843dd765c6ef7fc126e5717014d8f3d96632af45cc6980","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"containers.json","sha256":"5910e7ecf825f245bdb04efd246ebee6602f16b043a126a9e08eac18cc760f21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"content-prefs.sqlite","sha256":"c3d4e2ceb8d155191ff17baf9e0bf4e2aa52817f9af3a842a2eb7e76168b4a19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"cookies.sqlite","sha256":"b1849b785cf6785e11afe39ed08f4ae11ccbd9dbcfced4386ed445c634a11210","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"store.json.mozlz4","sha256":"344d6371660325d41a21534194bd1feb08cc4bfea009f44185d5d7995b744ed6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"1553183354175.70b17c99-2a20-4cc8-aaa8-3c5de9976dfd.main.jsonlz4","sha256":"82f0e3629ad3ec2210975cd0d7296e5800cce58867c21d6b5495c1d48a463402","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"session-state.json","sha256":"4c0d4b91b05611a917fd89db02ef6ee09cd881fec4a00dcb93190c090ac84d33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"state.json","sha256":"7e6807b0a4cb87e03f1430e0f9731f9608fef7f52546d035ba8f09b2b2a0cc32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"extensions.json","sha256":"da01f46ac721b3e7f67c6c3587b30f96e34b1f38efd6adae16f5204642f90a09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"formhistory.sqlite","sha256":"e38a2d6e5b75c9271bc94d39cd6aa2085e0eb7e7931db13bd59c2af9972f5ad3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"gmpopenh264.info","sha256":"c215d4d9f6cdfd37cacbe98054de98e9dd1cda173ff7d4fd7906dd784e0d97a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"LICENSE.txt","sha256":"b269f0771a138d19fec0fdf26c13dee17d478a9afd8226c54d2a806f4a384aa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"widevinecdm.dll","sha256":"97a5d3698894319877b42a0ead487d8806436671c1ed5317fa5d4240dd0572e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"Acrobat Reader DC.lnk","sha256":"56f38b7025b90ee87183b39d32fe049fab97e5739696f2335b2085af98cc1689","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"07c4.exe","sha256":"53d8a181ebdf1e3feb3c96e84a0299d8f24531ff20c9f69fc5841a0ed392ec96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"2VEV49vrsTLgZa.doc","sha256":"7fc2c0702b0ef98df268b94fb3d5367fb9fea75fb018004cd92d313415412ff5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"2f07Jm4brrx.exe","sha256":"b16abdc714bf049f99eaa843211d988ff62c4ff69dc01efe626ee7ad691455ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"3LnBJn.doc","sha256":"395a85a069514da604ee64880af95a1e49c056e292669af5f3b958dee9926bcc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"4RHcGmkB.exe","sha256":"ac8f8f185f4374d03e4df86ace54a065021a1541166722e7a67606be064db420","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"5F7TBCLUxJG.doc","sha256":"2d93e650b4b5b0d653bcef60bd9109462d40b9eaac853dfe5412db9b16a47bed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"603jOLdO.exe","sha256":"98b256e1e60d7295bd8ab9d967f8cce0e8f2591cc5c53336c2f36d32d5a175cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"7mOyQqezSRsEQhHm.exe","sha256":"9ad611eb55689c88415c88941db84627676e59676dde14cfdc10c7527520e438","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"8L418Npib.exe","sha256":"3fe2eba32987e0111e8656c2a4a605a70aa425034f1b49f3fb918c067e54f729","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"Ae5I9Tp.doc","sha256":"29d4c146bd5c6bc37196c0f913923974122d6fb557400569e0801d2d3b40b217","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"CZspj.doc","sha256":"551536e6b5b32c82e69b425b1236aa9d031aa9f701b09a93a07a782e4237f677","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"Czkv.exe","sha256":"116b0e220714676dc53074a4e2e48707598e43b66a25a9148c2bbc831bbac0f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"DKwpgw.doc","sha256":"46247daf616ea204f5e9de4e3fa4624b59d6a29d06da0bc936ae66afa63bddf3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"F42upSs.exe","sha256":"91f72811954c1b5c98de51d6a488e11c6b405f7f3fb759ac2040706d4b6db350","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"GgHlzQR.doc","sha256":"bcbbe6140e26530b4739a8b140ab5cfd70083f939b58749e793be57807388059","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"GmpsrAn.exe","sha256":"9caacac410a590ea837e67f6ca0ee893bcdd1d685dcaa646092f2e823e60d175","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"HoJQ.doc","sha256":"2d10e374aba1500515b13746afb8d699fcda25370129241d73a9940eded68f16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"JtmJWBb0bwcS.exe","sha256":"f09b36ac5ab273841b2bb34d89f42fe75ea7af0493bd0b9c70179db4237780ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"MXf3Y8G12MNbrM.doc","sha256":"fba86bf2308fd8123a3ccdff4a7be287c0d8e18c9be0df59c55dcce5f8c20290","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"OpKgf.doc","sha256":"4224bdc64a6b341a1af0a03a61044b1c04b08f5659e601fbc68a1c5b885cb532","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"TXnZ8wd3RZI.exe","sha256":"6950413dba9e857b541a813b15ca7852761b8794c78b092bc11d3d0dba2645de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"Z2WBj58d55LDmYTY.exe","sha256":"2fd3a1139c59f3fc1aefe746d358665d17c04b116c34eab06eb00dea2459ba52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"bMTL7.doc","sha256":"fb2542c604e8a132786ddad2688ccd6ced3abfa2005a83a8e3d9fca890fc347f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"cQTUR.exe","sha256":"2c043b1f72b457fd8c5407893bf06e4161ba06fe210f16bc681f205841ba1466","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"eVGu5yCg91A9.exe","sha256":"4a468c3530a5b01eea52ca846a543eb4e2dcd60c43dac1eac236ad30938a443a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"gtcmotdmF.doc","sha256":"91f3e9a42b6a191b4db7d1545455723fe468a5a1e7cc46620491fb6671558db9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"iynDCtAWKrZqk.exe","sha256":"f620f9a5e118ddb89ee0fdde7720ffb0cf6541cb15e09698a45364abb77116be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"j8Sa.doc","sha256":"2741bdd0b7820b4a11c50ab6a2601836738a47f424b4c76662b322c10b7c7c5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"m3I6.doc","sha256":"96e6a8cab78bb5836366e2b16d1ab9296af52b9f3971c65b9d7b7d0c1928068c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"naK1.exe","sha256":"2e825821707753cea7f433c3f3e2ad2ca03d8200646f554f0067a6f454ffa775","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"netyeHD3z7v.exe","sha256":"2eb1ff78a7115b1517311ce009282577a8f58670eae9a5bb56b6856605e71e20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"oJIkHjK96.exe","sha256":"5aec7e8f2240fef21651815e0744db324e6ba1b40d27daa0cc953772b55a2000","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"pJ5LdT.doc","sha256":"2dd8cba24468e2120cb5a8a727c16de0b4604eab25b63a1a3256f4c0f630919f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"piLMujsJtKhePpUk.doc","sha256":"2d053a2bc27d5c35c7f08ef25c63262f24372f9002c7df7a61cd59c25c594be9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"qtaV9p.exe","sha256":"17b3484d69ee814d03ac3de8697e8e5bc70b5564e36be9888919c39b234bf92d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"sFbzgHs1K3qLZF41.doc","sha256":"a90430dbafc7932a0876714a1e9076c32033d84c26ebce358a2e4c7f37cb36b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"tpnUorm2s9.doc","sha256":"b02cb80a82463eb96904cac35cda4c7d197773610379d6892e9607d8afc85804","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"uVLcWdEsjtuv46e.exe","sha256":"e7c3dfb00ab196bffea100a4e742f3ad1e748d0cb161ae80800f95303de2c9c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"xHkhUwrp.doc","sha256":"83cfd00c6e201fcb17c00b28c6e188a12f513dfd563b84a27f0affb842cd2f4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"Desktop.lnk","sha256":"46ce01dd3c256d9d217db8398a2af108b82cfa85ed0c275584587be7ca91543f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Downloads.lnk","sha256":"53949bf6430ca983fac98f37853d26e4719cdbc7a77c2f8c5b8de7dbb403d125","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"OneDrive.lnk","sha256":"6a42d1a0abc3e8df473fe040f160cb288e71df26559988d3364cba23fe6c6e08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"RecentPlaces.lnk","sha256":"42442d2d92947a73f24cb2f132897c0f0fc9ed96d4c57e7268e38694be7279b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"airappinstaller.exe","sha256":"ed5adbd7febd6a2f645bf3ad1b906a1e323aecb2f0be7e4c34f49d216c850d46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"securitypack.jar","sha256":"e129eb5cc166755469598ec856bd09ef281ca3e2770b8dd705c4196f04bd25d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"name":"helper666_up.exe","sha256":"5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"1553165315485.699c9dc9-bfd9-433d-b195-416cb4a128be.main.jsonlz4","sha256":"f2f99f3a40abbb7c6400420f30f58e94376edf1699c4a21a5e8cd42a79a79d73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"1553166943200.26cd3237-eaf3-434f-9b1e-82a8298015e2.main.jsonlz4","sha256":"9fb824ceaaf24eb5bde1cecea16542b8a11927637073ce946857eb0a62a4e09d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"manifest.json","sha256":"c1069300a873eb9f9d10d353e89fe5e317237fc100f917593ea6b2332d09d28f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"handlers.json","sha256":"499c0c50b8a1021efd9eb63782fc38f3c75ed9e7738b6d5cd277ccac87ef4f20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"key3.db","sha256":"b5413d227c69d34d908d98c5290a324afb88b337507fcf560616aa62b9418c2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"kinto.sqlite","sha256":"a1edd9a9f90b661495ce54387ab51904a2652218d05065e08f181723598fe85e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"0YdED8h4YnKljVf.doc","sha256":"2aeca6c4fcc9d8c72e5115a11af4a430ab915ad509ddc9bcd331d1116cbfcc72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"1LoWM7zNlVq8h.exe","sha256":"4c9c52a2dc4e69b42c4cffb53903276f372395d5eefbdc7c0f7d20dbbb304260","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"3TXw.exe","sha256":"25c631768621dc801c326d856891b10e533c2acda9661d7f0c27dd8674433cd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"3VBXaPVG.exe","sha256":"08f43fc09df7f094075e77fb4ff0906c519964d4f07b210b7210a8045043e578","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"3kNG.exe","sha256":"7a30d9d1b1df611a63c1c40c67536adf2fb25655977d5f013f3bc2c0438841cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"6JQvD1.exe","sha256":"d59b7098307102fc7b1b77b197c1b9bb2e33640981f443d1a5e24a0016db2e20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"7GXTVgCwg.exe","sha256":"26c0583fd1008eb8b23b1321a22101e99ddf2244c7f0d74b627fa8dee551eeb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"A6a4k093.exe","sha256":"f8c708ef07d88f1e08bea1cc9578ef69f459441f2fab940af17a0912993386db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"AMrt2OL.exe","sha256":"3c8a371a037ea80cab7c2eb94ab7bf25467ec05a6fc739c5222f386472e44280","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Byf3DiB7aX.doc","sha256":"fa846c8c654629966dd8f4a13132cb1638af57a003051f6d540a7c807b5b6d2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"CJ8ZksCqfYdg3Ha.exe","sha256":"8ce1cacc2b97ffce6aebed36056d2ed7b12d3f371bb18c5a9c494c2835188ec0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"CspyTJgM.exe","sha256":"6ed2bfbce8ce26bf698b4cdfec8422e2913322cdd99235e38e3bc219e295de5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"D1JACuX.exe","sha256":"01ce5bf34fb6ced669b710678f500dcf015cc31977398c0bed3285f687802fc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"DP001GCJ.doc","sha256":"a2f833bc8ed7dc944f62a0b59b430abc587a616439eec9dbe99894c109d9bdbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"DcNNjRAkEraNbP.doc","sha256":"0a6942a2befac6c4ed8c5701931c49c7d0d8f23f98b3e7562a161d2d90da4b8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"E68SD0Ky01dhTr.exe","sha256":"57e85f1e301c8bfd16fc6d46ea87faa90543519440d745122908b702cb0aad93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"EW9C2p.exe","sha256":"5aaf5e2c350d88b743dea7d95c6b7dcde0dbc9cb3a4e64d05c02f491b698cfbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"EatIg.exe","sha256":"3bf1bd029a4bdb70fa900ef2f86e06773a439a4802ced119cd2b9d14f72e2f3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"F3ECcNeSSZh2HHk.doc","sha256":"eb765e7dba6b381cbb1a6aac70d5037cac0b3dcc5d0b1cd7e4bb86675721b10d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"FjTsWkpkM.exe","sha256":"e5b285b057d9de0bbfd62a20b82f43b9afc3931a915fba9df20b644f81b5faad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"GuVY23qj2s4Td.doc","sha256":"54524dc422866e0bf2548578666591ff930640b6afaf41eefeb395482504b16f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"H5uM4HShGf.doc","sha256":"f27accee5c22bdc94eec3e889ebe32a1db8ef051df82d659f21e4160335de5a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Ho7euGVfWh.doc","sha256":"26715fa0ccf08c803f4ad70d27326f79bf84778b10cd722108cd2e941fd37970","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"HyhkV7STqOqjMtk.exe","sha256":"6eddf0ccaca6010bf4953a37801e1ebe18406972a0221699fdb468ee935eb984","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"IOR7TqkslejAq91.doc","sha256":"d89f75865431dc48289fb7b1abdb8c9d71e9016e46a72f1f5b1b16b5f0dbc909","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"KQNwhwsYVN.doc","sha256":"48cdd7064f0683a41f894dd72eab27841bf7c7b50addad86f3a26d1c3d7e730f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Kty1hE.doc","sha256":"7214411e30b10e25505ba42225f185937ec0632652a667f3c818b0b43ad78e68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"L8yloyiM6okRPgbd.doc","sha256":"f166d546529ce135e8a85fc92a2ebaf44b85eb1bf3641ede7ac6d1d07916d721","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"MCLvMmDoz8.doc","sha256":"1a594e271839dbc1f1aafc2dd0b86b8f4d715f2a3d2b2174f19afadad3c90ad2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"OCXh75SGcr7.doc","sha256":"e556559c3b3f9de9660fc1d715ea844123826d48627528b5473c209add9a1cd9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"P7FflJbOH.exe","sha256":"36d73a23c250aa66cb9b0c4a6825eb7f499ce6fba57b03dcf2db6fb9e01d9bd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"PaGnOfAFV.doc","sha256":"9124c6eb7bea84d4910cef9367b7664f4ed3ac635112be7b41278139b7cbc1ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"ara0UGGW3VRU.exe","sha256":"b76c90fe2f70106af272da83603d07376b0d4f5b38cedb1a876b8c7c4c272290","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"cUJpjDsZO.doc","sha256":"4db89626ed6b4a29459e5c7b6c258155ee3b8293abbfbc347c6b05102d92674d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"dSTEZHvd.doc","sha256":"201335ac358c77baa2f588c980502996aec480ecca9ed10c705fa4f646a48830","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"dsYny5bq4UJV.doc","sha256":"9989058ad84928d9f6bd01d181ce2c1624351f1d3bc8e716d5eab5d5c3916a13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"fxlTZfcB.exe","sha256":"b16e6fe88ad04667beaf30801de9e46944932208d853babb9d5499866634bac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"g5pB3.exe","sha256":"cdb47936881a733c521795ce4cd5c7bc1cbe0e8c1021c2839f1595c7d43d62e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"gBiUJ4TRATi57.doc","sha256":"741f8919c1383a08974786b095a5932fa8d01b438f6a95ff8b629e6d5de25587","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"giDj6Q.doc","sha256":"ed987806edb7c3197d3e9043e4a93c00daedbdb690873f3907c3d806d37c0477","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"gmSsIkVXD.exe","sha256":"1f3a612ac4536922f86e12214d659b26380f8ef3ec686821014b00c10ee7d6b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"h8fg9WRouk.doc","sha256":"788deda528cb957415517f9e0e4129e8c967d8cde32ad020a0399cbbf7d5d668","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"hgUOm8vUl.doc","sha256":"25b585ad657dd47109a4f875e7ece2de0baf3c7dc426ce96c7afd1b0f3808c46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"jLgQj5MNMjfkAYq.exe","sha256":"96b667b3cfb65921fd45d191876dc6316a4ef70fe4c6d567db9d58afcd56d457","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"jR4UhePpkWKtU.exe","sha256":"817fed5147d184296ae97ef319ea1963cce26b8e0a902ef36e9198df7784aca3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"kM4aPm1y.exe","sha256":"5e1b9e4b8e9fb21d13cfebb479cf5e5073a29b7f7bbcaa68f6f00dcc68e1201d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"lKxIrwOivZM.doc","sha256":"8b296f9f13ad855fd9989b2051f92118bf182e80b89fc572625fa921b75e1c21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"mgF1qbnPMDZnVB.exe","sha256":"96bfcd45ede72746011d27ea1f098bac74d724d686728ffa52c7e457623ad8fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"oBqqx89Mp9N.doc","sha256":"1b4dad75eea244e561dd05c3351c5fc221860603107804382da0939cf2a01df0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"ppGWUpWSWorQZ.doc","sha256":"4fddaad3a114b65db752d63beb0019d8f213e73dbe78a37774433daf6c687404","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"autoexec.bat","sha256":"a9011056653bb2319fe8ec850df27e05ac0baa61e7211428f33f0f6fee75a608","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"nokia.pem","sha256":"8979b885bc30b64bbeb3a080e96d742075b342abfeb7ef247cdc489b933866e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"pycacert.pem","sha256":"e397de99773ff53edf687a33d4f8ae13a4cc2845bc3e4d963ee05c0e3dd1ea6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"keycert.pem","sha256":"2e86c44975dd9626a9fe27c66e7c6d238059d16f35ed9c95433657fdd4204acb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"pip3.exe","sha256":"a0ba43af94489a35cd7a84b647bef5237b1a5bb99792a7a3da79368ed93f9389","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Install.exe","sha256":"6516c3789e216efdca80e3cf3566f311ba3fce07d4a9575633d49442d3cf9ba8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"easy_install-3.6.exe","sha256":"780fd0a9fbdfbed339fb75e28cf64f099c806660e37dcf404d49a95d775d09f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"dh1024.pem","sha256":"779d5d590b154326693cfc2bb256c1da36876c505ada5e822cda046d578e8aa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"activate.bat","sha256":"8e1285f56ba99258677f2a5b2322b7997a64e0315a4930053838eba858ec5827","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"empty.vbs","sha256":"f52f1e197d1c0ce9a5fb2d1b8c5048a43e349ad50299e609f0d5dbf6819e7476","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Activator_Office.exe","sha256":"c481bcc4325f323950a7fb9203899d89f1833e909857e91309d4c3f346a4fe1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"keycert3.pem","sha256":"1b079b1cc9455b253d03403736a4b8a0f1b69e8161e2a2a892c01024278fa127","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"pip.exe","sha256":"455bfc6c939f0aea635107cfcf3472ede6861227d3a1ab386a4b749ee2d118fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"keycert4.pem","sha256":"cd3c57b8a74fae7159105b4c7cbc48269fbdf2aa74bf27523401bf82079a3dce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"pip3.6.exe","sha256":"cc3644b592baf82b1886263ae69c3d1c4c55943fa4121a89ce77b1b70abc1d76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Hancom_Office_2010_SE_English_Edition_3PC_1User_Downloader.exe","sha256":"1383be46c05baa7594d0f5b110dfe163040e491ed5cb1d4b7dbbad3a5ab46719","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"ose00000.exe","sha256":"e86245394d9f50afe3d7abc1d9d6d531a6e1d88d05a94a54b29772d20996ad1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"OSETUPUI.DLL","sha256":"37a20fff53001cd4b51895309ad80587d0dbda150770eae64517eedfa9a87101","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"deactivate.bat","sha256":"b659016c57932c89942f2adfb356eff507b5eda3b08b8fc119c4859c3c9ae60d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Hancom_Office_2010_SE_English_Edition_3PC_1User_Downloader_1_.exe","sha256":"66c88e353e945fc11795673348a5f51f4b5922845f3c0fa07d3387aa2d08c287","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"keycert2.pem","sha256":"bde609970509161ccf6b350cb4600bd5db8de5fe0b69898ac166d5b79ceac389","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"nullbytecert.pem","sha256":"91f3c772ca6d95254b122a1e1aca1884436b8b4862f33c32e4cc3035fca32d84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"badcert.pem","sha256":"861704d98b67d59a91146fbf75203b325ec6e028dbcc970d19fd3a5ce102b540","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"easy_install.exe","sha256":"d2b6189fcad62c78bf48fe735a4b7de8e2673bd0b69be4c4bcdf79cffc3b6052","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"Activate.ps1","sha256":"5eb973d36c4b7682fd0cce9fff89bdbd32eb66b1657224da00257613ce0c2eee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"AUTORUN.INF","sha256":"4453ae5e7242eb225fd1f213969bd29b903698d943df2066f3ec654336d959ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"pycakey.pem","sha256":"35642598e2f6922f0f81bf3fdd8cd65c840c07c12476edf2f66c337a1387b56e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"keycert.passwd.pem","sha256":"38b453c622920d2e6272c9e477896f1d5f172093cf15bf6c4b31e5af29679c3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"badkey.pem","sha256":"06d6b1ad276df28d50823656bb6df1a0befa480e6bcefda6260997ef3796826c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"name":"allsans.pem","sha256":"948fd8d6bf39038696cb201e230ebb91ceee72c45305df06a779c98a157dc04b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]}],"files_written":[{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"C:\\share\\1567110262104$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"C:\\share\\1567110262104$OK","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"C:\\Users\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Videos\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"C:\\5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%LOCALAPPDATA%\\5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"C:\\5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%LOCALAPPDATA%\\5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%PUBLIC%\\5177E07B01A4E8879085AC4DE1459A2A4EBB486AA3982CABE3094E7BC6D6E6EA","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Recorded TV\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Pictures\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Music\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Libraries\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Downloads\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Documents\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Searches\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%PUBLIC%\\Desktop\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Saved Games\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%USERPROFILE%\\Pictures\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Videos\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\OneDrive\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Music\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Favorites\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Links\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Downloads\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Documents\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Contacts\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Wireshark\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Desktop\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\AlternateServices.txt","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\SecurityPreloadState.txt","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\storage\\default\\about+newtab\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\storage\\default\\about+newtab\\idb\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\parent.lock","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\sessionstore-backups\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\storage\\default\\about+newtab\\idb\\3312185054sbndi_pspte.files\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\gmp-widevinecdm\\1.4.8.1008\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\gmp-gmpopenh264\\1.7.1\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\datareporting\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\datareporting\\archived\\2019-03\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\crashes\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\blocklists\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\fg6ygf16.default\\bookmarkbackups\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"}]},{"path":"C:\\helper666_up.exe","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%LOCALAPPDATA%\\helper666_up.exe","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"C:\\helper666_up.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%LOCALAPPDATA%\\helper666_up.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"C:\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"C:\\share\\1567009927512$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"C:\\share\\1567009927512$OK","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Documents\\hancom\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%USERPROFILE%\\Documents\\Amazon Downloader Logs\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\AlternateServices.txt","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\parent.lock","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\SecurityPreloadState.txt","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\temporary\\https+++www.google.com^privateBrowsingId=1\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\about+newtab\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\about+newtab\\idb\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\about+newtab\\idb\\3312185054sbndi_pspte.files\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\sessionstore-backups\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\gmp-widevinecdm\\1.4.8.1008\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\gmp-gmpopenh264\\1.7.1\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\datareporting\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\blocklists\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\datareporting\\archived\\2019-03\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\crashes\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5d65673e03883816855b1bd1"},{"report_type":"sandbox","report_id":"5d66ad1d0288384c4c4d3199"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5d66ad1d0288384c4c4d3199","5d65673e03883816855b1bd1"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.GlobeImposter.Generic Sample 5b2045f86626… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5b2045f86626…. Malware family: Ransom.GlobeImposter.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.GlobeImposter.Generic Sample 5b2045f86626… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5b2045f86626…. Malware family: Ransom.GlobeImposter.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5b2045f86626ea4bfa7d6996e60146ca7d5829d28f178798d4f68e8a2e62da85"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.GlobeImposter.Generic Sample 5b2045f86626… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5b2045f86626…. Malware family: Ransom.GlobeImposter.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]