26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4b8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Paradise.Generic Sample 82cfb70e00f3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 82cfb70e00f3…. Malware family: Ransom.Paradise.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80","keywords":["Malicious","Ransom.Paradise.Generic","malware analysis","sandbox report","threat intelligence","82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80"],"about":{"@type":"SoftwareApplication","name":"VID495097072.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Paradise.Generic","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4b2,"autoexec.bat" has type "ASCII text with no line terminators" "AXE8SharedExpat.dll" has type "MS-DOS executable" "Test2.doc" has type "Microsoft Office Document" "MSOEURO.DLL" has type "MS-DOS executable" "Eula.exe" has type "MS-DOS executable" "hxdsui.dll" has type "MS-DOS executable MZ for MS-DOS" "ViewerPS.dll" has type "MS-DOS executable MZ for MS-DOS" "ccme_asym.dll" has type "MS-DOS executable" "AcroExt.exe" has type "MS-DOS executable" "OfficeMUISet.msi" has type "Composite Document File V2 Document Can't read SAT" "notepad.vbs" has type "data" "BIB.dll" has type "MS-DOS executable" "nppdf32.dll" has type "MS-DOS executable MZ for MS-DOS" "BIBUtils.dll" has type "MS-DOS executable MZ for MS-DOS" "PidGenX.dll" has type "MS-DOS executable" "install.res.1040.dll" has type "MS-DOS executable MZ for MS-DOS" "Application Verifier.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Archive ctime=Mon Jun 15 14:20:54 2009 mtime=Sun Feb 15 11:59:43 2015 atime=Mon Jun 15 14:20:54 2009 length=163944 window=hide" "dwintl20.dll" has type "MS-DOS executable" "ASWhook.dll" has type "data"28:T627,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll.aux" "" touched file "C:\Windows\assembly\pubpol47.dat" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\250e8e6af918e7ca66787117bc8633e3\System.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" "" touched file "C:\Windows\System32\rsaenh.dll"29:T502,"deleted and you cant decrypt your files" (Source: 82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80.exe.bin, Indicator: "decrypt your files") "[WHAT HAPPENED]

Your important files produced on this computer have been encrypted due a security problem
If you want to restore them, write us to the e-mail: info@decrypt.ws
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.

[FREE DECRYPTION AS GUARANTEE]

Before paying you can send to us up to 3 files for free decryption.
Please note that files must NOT contain valuable information
and their total size must be less than 1Mb
[HOW TO OBTAIN BITCOINS]
The easiest way to buy bitcoin is LocalBitcoins site.
You have to register, click Buy bitcoins and select the seller by payment method and price
https://localbitcoins.com/buy_bitcoins

[ATTENTION]

Do not rename encrypted files
Do not try to decrypt your data using third party software, it may cause permanent data loss
If you not write on e-mail in 36 hours - your key has been deleted and you cant decrypt your files" (Source: 6000015-cctor, Indicator: "decrypt your files")2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790442253096,"unified_at":"2026-09-26T17:04:13.096Z","metadata":{"hashes":{"sha256":"82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80","sha1":"6971f1ed238740b3686209d36764e22b0afead30","md5":"401c7defd9815701931765c4e8b8d8f9","sha512":"dd9d9f02d2d343b9e7b64472f3a2f0a9a230df43b790ba5b9e7d35eb85614bddce61d20c0c75f4c33d3b5b41936da6ff6b8b409b0ff4e41b3b5cc22b0e51fbf4","ssdeep":"6144:HBSZKZmZKZmZKZXzQptXzQptXzQpt0bbHJJA:HBSZKZmZKZmZKZXzQptXzQptXzQpt0bb","ssdeep_chunks":["6144:HBSZKZm","6144:BSZKZmZ","6144:SZKZmZK","6144:ZKZmZKZ","6144:KZmZKZm","6144:ZmZKZmZ","6144:mZKZmZK","6144:KZmZKZX","6144:ZmZKZXz","6144:mZKZXzQ","6144:ZKZXzQp","6144:KZXzQpt","6144:ZXzQptX","6144:XzQptXz","6144:zQptXzQ","6144:QptXzQp","6144:ptXzQpt","6144:tXzQptX","6144:tXzQpt0","6144:XzQpt0b","6144:zQpt0bb","6144:Qpt0bbH","6144:pt0bbHJ","6144:t0bbHJJ","6144:0bbHJJA","12288:HBSZKZm","12288:BSZKZmZ","12288:SZKZmZK","12288:ZKZmZKZ","12288:KZmZKZm","12288:ZmZKZmZ","12288:mZKZmZK","12288:KZmZKZX","12288:ZmZKZXz","12288:mZKZXzQ","12288:ZKZXzQp","12288:KZXzQpt","12288:ZXzQptX","12288:XzQptXz","12288:zQptXzQ","12288:QptXzQp","12288:ptXzQpt","12288:tXzQptX","12288:tXzQpt0","12288:XzQpt0b","12288:zQpt0bb","12288:Qpt0bbH","12288:pt0bbHJ","12288:t0bbHJJ","12288:0bbHJJA"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"VID495097072.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":264192,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1505558302000,"last_seen":1689210964000,"last_multi_scan":1689210964000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor","ransomware"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":6,"suspicious_count":9,"malicious_count":3,"total":18},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.fykmp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Paradise.A49BE5B1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Paradise-6336329-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Paradise.A49BE5B1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Filecoder.Paradise.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051a8061 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Paradise!401C7DEFD981","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.esqpqb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-ERB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.DN-Agent.264192","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.A5E40E4A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.A5E40E4A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/A-17b8a5e1!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.6199","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Paradise.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"autoexec.bat\" as clean (type is \"ASCII text with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 68EB0000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 67B40000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://localbitcoins.com/buy_bitcoins\"\n Pattern match: \"http://178.208.77.47\"\n Heuristic match: \"info@decrypt.ws\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"AXE8SharedExpat.dll\" has type \"MS-DOS executable\"\n \"MSOEURO.DLL\" has type \"MS-DOS executable\"\n \"Eula.exe\" has type \"MS-DOS executable\"\n \"hxdsui.dll\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"ViewerPS.dll\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"ccme_asym.dll\" has type \"MS-DOS executable\"\n \"AcroExt.exe\" has type \"MS-DOS executable\"\n \"BIB.dll\" has type \"MS-DOS executable\"\n \"nppdf32.dll\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"BIBUtils.dll\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"PidGenX.dll\" has type \"MS-DOS executable\"\n \"install.res.1040.dll\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"dwintl20.dll\" has type \"MS-DOS executable\"\n \"DW20.EXE\" has type \"MS-DOS executable\"\n \"offfiltx.dll\" has type \"MS-DOS executable\"\n \"NPSWF32.dll\" has type \"MS-DOS executable\"\n \"AutoIt3Help.exe\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"vslogui.dll\" has type \"MS-DOS executable MZ for MS-DOS\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"http://178.208.77.47\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$29","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 650 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"MyProg.exe\" claimed CRC 1475927762 while the actual is CRC 294522","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"MyProg.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"53/66 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"53/66 Antivirus vendors marked sample as malicious (80% detection rate)\n 9/31 Antivirus vendors marked sample as malicious (29% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_ReadMe_.txt\" which has been seen in the context of ransomware (Indicator: README_.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":32,"dropped_files_count":0,"extracted_files_count":156,"files_written_count":46,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor","ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"59bcfbdb7ca3e12ec75a3475","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","submit_name":"VID495097072.exe","analysis_start_time":"2017-10-23T07:20:04+00:00","indicators_count":{"informative":6,"suspicious":10,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}],"processes":[{"pid":3320,"ppid":0,"name":"82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80.exe","command_line":"","sha256":"82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80","normalized_path":"C:\\82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80.exe","uid":"00014305-00003320","icon":"$2a"}],"all_imported_dlls":["msvcr120_clr0400.dll","rpcss.dll","crypt32.dll","diasymreader.dll","usp10.dll","imm32.dll","cryptbase.dll","System.ni.dll","KernelBase.dll","msvcrt.dll","mscoreei.dll","lpk.dll","msctf.dll","mscorlib.dll","shell32.dll","mscoree.dll","gdi32.dll","rpcrt4.dll","clrjit.dll","oleaut32.dll","cryptsp.dll","ntdll.dll","kernel32.dll","advapi32.dll","mscorlib.ni.dll","sechost.dll","shlwapi.dll","clr.dll","rsaenh.dll","user32.dll","ole32.dll","nlssorting.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"autoexec.bat","sha256":"ed85e5c6cfa94e4a4f558a991c98b8f5932dafddb1f1c239c5681f56e0f392e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AiodLite.dll","sha256":"f5656903b897355679b7aac1fb624dc73c7a4d290aa28b4bd096966905ec6549","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Liesmich.htm","sha256":"15e688090fe17ddb8e3e3417f2d5757131799bc8f15d8caf12e5bd554def1633","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ReadMe.htm","sha256":"908394355e251d8cbbfc3b277b95ce7caa9bab4b45add6b61159544a94f4df7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"A3DUtils.dll","sha256":"78d7eb94b6710ba690ab21b727a55bc7e34754377109e4310e6de94467c95421","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ACE.dll","sha256":"dd49fe830f4ee14b7f22cf32416dfc5cccbdd935be00d154759cc21087120cac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AGM.dll","sha256":"d283fa1f02c6d8329a7a0363f0416af48079951feefa71abb46eac2766131ee6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AGMGPUOptIn.ini","sha256":"6419d0b3eb9ab636dd8e914480b63ce9133a97a278d96526bfd5a1be4d982c23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AXE8SharedExpat.dll","sha256":"118055047ae30f16373084308af5863f6d02c21eddda6facff6a0b28d2351aff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AXSLE.dll","sha256":"e6575e7a5339af6255518f1944aacaeed8e27da752c129ef2117b7f14fe1b29f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AcroBroker.exe","sha256":"d9d214ea6006ef1cfe6e1de2d35c57582d5c16d3bff19110e170fca981265a14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AcroExt.exe","sha256":"5553910da6377661673373e5a1324975d4bf987d9f31038411a42ca3d3dc5720","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"cef.pak","sha256":"7be7bb3796a77f05426be541862385a9a6f2dfd23d23679b89ddc0f3b46931fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"icudt.dll","sha256":"54eee025c71217b30400f8af0a16eadbb2ce9fd86c78adb223b5aea340619ac5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"en-US.pak","sha256":"e8cc3be22e6194993a6c9e4bc62c43b7c26821c33c35f05a79b35a9b64df2dec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AcroRd32.exe","sha256":"98b89fd1ca7d1442832ec9c4464e1a5c13444d44da09a78e701ff47412b7711c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AcroRd32Info.exe","sha256":"64fd54eca2b2c56ce42a813748d25d04cc4eb2bb8a6921fc36660f5506265d63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AcroRdIF.dll","sha256":"9c87220271186e55b55c7066bb3cbfe3fb2fef35f8fc9d797538092d3e457314","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AcroTextExtractor.exe","sha256":"edad004587a9d46952619590370553d7ce6bafd8e49c7c605bfa37b8ab91facf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Acrofx32.dll","sha256":"227f0be8d98c92920018b52526da718fcd74eadc602c7d6b7af523d28beb324d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Adobe.Reader.Dependencies.manifest","sha256":"c5ff88780b769c385d57407977e1527d7c4e3543e48f3d60c7298a9c7fdfd481","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AdobeCollabSync.exe","sha256":"1fc2331bb589258f4c92be64503ee7655c48cc76381e85b5b9938f1766835816","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AdobeLinguistic.dll","sha256":"0d556233ad402eff4acc2c15a16323c6e5e66723f3bc41782ff286190975d523","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AdobeXMP.dll","sha256":"c67070017453979c3b3640c948eabad41564be3c8353a746cea7e752975150da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"BIB.dll","sha256":"67c77f9e15183bbdab52693e04d7c2fd53a59d02f83cee98ed371b969ca43e94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"BIBUtils.dll","sha256":"02f7d528951e3ae7c3e816eee94841e452fc4cda678e177d246c9ef71106b77b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"nppdf32.dll","sha256":"d2e223527319d67cd86aababb2dadf9568b64716229d3ebb13b0d0d6d533ac32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"CoolType.dll","sha256":"2896b558a4f4317ecd4cf0841bec163bcd7c5d863e8886c0e53fe652a38c2f12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Eula.exe","sha256":"376d6f7cb2b3e913f7eeacd10d154d9bb5a0f30fbf19c100a7433c5ea55ca08a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ExtendScript.dll","sha256":"40aebde2b2557a3b8d196f2080ba67c28cb22571cbca48c61759f084b43cc697","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"JP2KLib.dll","sha256":"c670115e072824a6502123b7afd9b48babaaebe1820b3823201f42c9ee31eb3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"JSByteCodeWin.bin","sha256":"4abff1e94a4e10c3b1977e4be2c8a7adedc8e8bec69f57ddc721cf658fde4f09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"LogTransport2.exe","sha256":"09b97eb8257f0d8e06f4112b9fc229127dee03510698c62ccbb946d6c02cbea3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"NPSWF32.dll","sha256":"a145f72abdb402efea835d0ce5b2a0256136f40edba936fc90d19d7d4bf77aa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Onix32.dll","sha256":"74f60ebf09ddb0c2e2a31c2584f18f082e018bf0c322d87e9fd43e41519fbc54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"RTC.der","sha256":"ed3ba066f7c198535574225185757ba9866dc2fde8131f6f33d649563ae5612b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ScCore.dll","sha256":"496585299987343270cc710707e4bb3bcc240ef4f6eff0974495b7f68c4ac210","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ViewerPS.dll","sha256":"ae1a6afce083b30686a1b3876920f9b8dcc5dd7e5a8b108b9472a1591f7c70d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"adoberfp.dll","sha256":"7cef15c819fc7886dad138ef7449c97e57037d4a1dda5ab095e89776279de043","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ahclient.dll","sha256":"5c4c5fd08dbeeb96d5c928d3cf4cec0a92a468b7b6bb4e34ad334353cf823689","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"arh.exe","sha256":"448acba741575ed35b0b2c97e77ad2517925053a715651963a9b9b47f07f5672","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ccme_asym.dll","sha256":"2024f1336608d70e0f8636413d1a36b732f824caccbdea564fa4ec3101979653","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ccme_base.dll","sha256":"ba041f3fa8b4a22d0f858f8debe8e4d89bcec29f5f770f313bf723e8d5ed7ab9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ccme_base_non_fips.dll","sha256":"abc0dca647ff3a5a7175c03e62839011b65fc79d7766984f6659ee3ac0ef96eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ccme_ecc.dll","sha256":"7a337f74500fa1026f3c4dbad66edda78ad557f5b939ed841ba2a855e2156797","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ccme_ecdrbg.dll","sha256":"8e217dbedafcbd83a0908eace6faa4b58b9a88af9a8fa98e6665dae0345f2cb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"cryptocme.dll","sha256":"8776cab5aa06f82ca40af246ebfeb4a8f9fb88d154c70843f5670235dacf0a5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"icucnv40.dll","sha256":"1b3f7e0c5ad1b911637913993b36a1fba9fd8dc44ca49470c46ccfd9bd8958e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"icudt40.dll","sha256":"6931a1114c4b0d8e6b390ffbdd279d801a65bb6d665fab88a32efc46b3ca47ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"logsession.dll","sha256":"0317448af177be7ecf84659572c4b860f68bccf4424368946d3ba395b2c1b75c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"pe.dll","sha256":"1bd2463c26fdc9ad1358358b3cef301bb969f1dc6eb78b9319ae12a3197ddc33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"pmd.cer","sha256":"44835e1eb1f3a999174e6a1c36e6803a6ee33ec6b3878de9e4045eef4cb626af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"reader_sl.exe","sha256":"ef6138c72217d7422aba8611e351187742f8bd0ab303e5c56ee3226db5df5188","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"rt3d.dll","sha256":"e2baebb88ec575ecf66061d2f9905ad220278bdcc726209fcc4a5c7774290fb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"sqlite.dll","sha256":"4580d145f732bd5691428767de6ee315adceff8a7bd33eefdbd5383b7548cb9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"wow_helper.exe","sha256":"44aad72a68a97849fb0452c7615f963845f5d19b30db9afd582b71a1fe274ee0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Office64WW.msi","sha256":"bbdceb0ffbd2b35df8df7d16dbfb4dd82e4c2da7137e764ed77c637ee5925e0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"PidGenX.dll","sha256":"871497113f46a5b0fd3eca9749dbdb2188e5cb51fce683d59618bf0e641b8cc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"StandardWW.msi","sha256":"7dc2a4903b8119999c31ebab9f1b716729e052a335140add8e9823e48ba09f7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ose.exe","sha256":"a61d487d41977ca1328f28454e92f44d804e57725b284192f66c54c31a1b8004","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"osetup.dll","sha256":"2217c1c4afa4a483bb72aece96bfab45ef5fb88b9ddef30f95fa6bd7ef2f6282","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"setup.exe","sha256":"a3274461e5dd7e87b2e74bca77119d36cd1d25dfce93ed8832a1ade09a4113f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ExcelMUI.msi","sha256":"4280189daa9804d762a33a903f12c6b8729e62b08ede7991549fa6a28db116cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"PowerPointMUI.msi","sha256":"0842af8626bf266f45f43c8c783cf5952e8f92981b2716465becd98ce3d803cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"PublisherMUI.msi","sha256":"503af11a78dbee1c4ea624c33cac673950216ab1cbf165a7e90a39a67b8d3a44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"OutlookMUI.msi","sha256":"82b504e268813a03f64b49fa462fce65ed4d2c53dde8900ce306958cc38c3efe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"WordMUI.msi","sha256":"09e45ef70b91b5d8a614eee691b7b0cf129adc956cd4817461b2a7dc0c507de0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Proof.msi","sha256":"ef45c6a02610222c437fd7c6bc1e883551f4e524a841144bf9650d620c16c976","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Proofing.msi","sha256":"e6aaabd91630a27e8272e7ae8bf28f7bb24ceb1cd7e8c80a6d3f8f34e94b3e21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"OneNoteMUI.msi","sha256":"7c14fa5081cdbcb3a9d8f716761811ed86501f7597cd4457c4e808a94dc5382e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"dwintl20.dll","sha256":"170c1caad1b2d398058764ee9870a6d7e5e0c33368e91c6200843d9a10b5e4af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"DW20.EXE","sha256":"f3411a2a97c3f6e3b4b0776cd6b9ffa3f611904d454cec8759140452f604248e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"OfficeMUI.msi","sha256":"f3370633cbd140b99cc71af76ada13cf34828ea36dc04549b02b572bd16c0763","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"OfficeMUISet.msi","sha256":"6c3d6e6c7f2faaeb36632b4b5a329fad608a21edd41cf9960282192afcb6233c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"dwtrig20.exe","sha256":"d7c3940e6aaee0d8517c5add61371455a326e55efed31c6240e065b44d7b4036","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"msvcr90.dll","sha256":"d015075a472086c2ab6107a2346204555dad11b44fb5534c0df063f95c4e95ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"osetupui.dll","sha256":"dd9f1b4eccc8fb5dc161457b86dca611c732a686dc32c5270fba1f95688ba0cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"pss10r.chm","sha256":"acf57a4a98b226596d9e3339b1880eedf500d1fa0740060d5fed9739366c5af0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"setup.chm","sha256":"c0515e7d60cb90538590b7d538a31d3aabace5fbed4f82035cfe65bb101dddf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Test2.doc","sha256":"e37491062372ade6ee5ad20f557c7e7f2f1df22f9035c99091ee2f08c158e0eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"MSOEURO.DLL","sha256":"42f063072d29f3e750229becdf544349a1ebeda5681b7222c50acce085878ae7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"hxdsui.dll","sha256":"3a550b1b0f831f4605cd6a349b33a26c3282c4b4e243f0870775aa24bcc202f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"notepad.vbs","sha256":"7ae8f4db85fbf3fe87fbc5f9e235dd4d7bc5896fbcffe3e7849350770b96b001","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"install.res.1040.dll","sha256":"f0fea147efc4c605565f3d886fc9ed35afaa93f673ca6a294ca3698505510482","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Application Verifier.lnk","sha256":"7f209802ac070ed73f28396cebc33c3f18042cf26d81d7e3d17c7bf8e24090b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ASWhook.dll","sha256":"4449451c71a33e65c323f7066621b3de1bb06340bb459f149a5c97d9fc31091b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Worksheet.xls","sha256":"ed4a8069d43e5e3bfca6afc55216d106a495e16991cf00f414fc4173ab41778f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"offfiltx.dll","sha256":"f6cdaadd4dfb02c8654cf5f565e905675dfe9356b574cf21a3e69e647e19c148","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AutoIt3Help.exe","sha256":"5022df7f120e7d27778ffbbdb731aa0db6962e63a450be5b1c8dc284283fd1eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ShellUI.MST","sha256":"4fe5bf59fc1a5e2a148eb86f3e67d3a7d89a28abd8badc39c1f5f2ff828d0a84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AutoItX.chm","sha256":"779862be74ebc35cc5d438b2ec11577487c3b60d48e673ae2409b7bb6c05ca90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"vslogui.dll","sha256":"ded848522d66278f99a2af89cc4e3e6fc44901d26430369a56314812e503b814","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"odffilt.dll","sha256":"d7fa7d2a781d79dd7aadf528d5d0028ad2d928014adf12966506e01578a9adbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Au3Check.exe","sha256":"7910b349ac75dfd214315aa2610ac884df8937006faf281372692781ac5b7ce4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"dwdcw20.dll","sha256":"8fc2c14de1978254d054eae2f663afa8f8e53a228a3d97a794138362f2185904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"jucheck.exe","sha256":"8b32104dced03983faf5614eaee763360c2577191536851ac9f86fd919248303","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"hxvzui.dll","sha256":"6a0d2b9cd49234da323326ac0d67f52c2043b7294ba9153701b30d1c01983722","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Aut2exe_x64.exe","sha256":"a34fb9ab149f48cd538e041cf4212809f4962055305119d67812b535ae78e291","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AutoIt.chm","sha256":"5b11fbc945594bb542ef457ffba32ab76de6eb162d7861dbe56fdc54213299a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AutoItX3.dll","sha256":"934c54ec90daa062689f74344ac266e0d6f31ff8f3fbfbb76e29507bd81f7d1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"install.res.1042.dll","sha256":"32a315cbf6512eafc3f232e912f3a5e0310873db5269676e44d1a348a5ed2a8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"cmddefui.dll","sha256":"6036416f149f1f0595fe2c8b6860ff2285fec329464855369194994dfcdf9949","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"calculator.vbs","sha256":"03f138b662adcf0eb77800e58c5536439109d00aa56ac17e56cbea58e881d050","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"upx.exe","sha256":"67851998ea4a5723222de65fb464b1a79903c139af329a41977c97f2cb184fe2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"_Excel1.xls","sha256":"936f8149d75bea0166392239c6e9b66f70a56591117c54e369db4c2ba5be60f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"MSADDNDR.DLL","sha256":"81bf863b6013bf71a0b3dd7f1a4dcacb1ee1398f3f872f9e0c44fb854378f379","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AutoItX3_x64.dll","sha256":"8e87a2ee09e1692c28b04d09cc56e11eb1720f922b290ccf5eaa27de05c0c75d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"custsat.dll","sha256":"29848f606ac41c6f98e90ee865ab0d96ebd51b57a00a8210075fe646892528f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"_Excel2.xls","sha256":"7b650d606d78dc55ebe3ee9bfbee554116047c87804d870d61a26939f4245f33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"DWTRIG20.EXE","sha256":"1365c1e9ad96f7064102772a52193ae07e34ce3f23ccded8e61d4307587056d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"install.res.1031.dll","sha256":"17bea7275c0b719217445118cde7af1dd35c62bd52d7e33171f90081b92a236b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"MyProg.exe","sha256":"ba391a78a7a48fae14cdf9d6aeb81c87e043ee5a8ba179dc5e6aa4b32541d66c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"EEINTL.DLL","sha256":"aaeecb4b2fee68a44988e228c0804b1e4719d1a1ab40dd60f3d313306e09c509","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"install.res.2052.dll","sha256":"753d0a06edefafcae3f17347120e868a5f58013889d4a5a69e4927997ce70e87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"install.res.1041.dll","sha256":"238031da38ade385b7da11cf03f350715bb7102cf1f0a500b0d4c268e47eb919","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AutoIt3_x64.exe","sha256":"aaea1e4a3982277bff9268134bb9d31183c3c89b7bc1a43f359161db58deb363","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"hxds.dll","sha256":"465c7335c95e3f5caa55c07ba52fe91d254f3c1a13e964d45ec1b7e88b759af3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"EQNEDT32.EXE","sha256":"9e8ccbadae3f494cd05dba51a3a4d5d153486248f18061d42da698a2202b7740","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"install.res.1033.dll","sha256":"81f5b1c420a6c86a24ce520d118a9b8cccec4603caa274c77384bd333f50a7b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Resources.dll","sha256":"d1657793932b9aaf0b45108e32873b420aa202cb0b277600e81b91ccd06700e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"ITIRCL55.DLL","sha256":"c00ae15c84e3a0ec8f234a8588cec7cd651287893efef2e145b0178ce812815e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AdobeARM.exe","sha256":"6eb7645715af5a0c8d0772d258ed4515446588d2718bd03ee36114ab32993cf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"msgfilt.dll","sha256":"65ebbf0f6b674e3df9d1f882cb6b211f9178d643fe9614842a54e7e3b0a3288f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"install.exe","sha256":"723765c61cc13676133bc0f75e6db81095fe012cae3c8cae8842d26bad9b83f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"install.res.1036.dll","sha256":"5ce583a568ba800258fb2ae817ff59526131d0e51cdbec61fdd57187c79f8d79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"install.res.1028.dll","sha256":"564a202b233186deaff8161271882c20b4b52b823fefc19fb7cdb73aeb891406","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"msitss55.dll","sha256":"f407f4c691c2c26de3bade93507816f0dc205ab5fb342a5d9422f19e9bbff732","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"_Excel3.xls","sha256":"03980e2b16c9df8e98c0331e9264a29c4fc774a6bebf5ef0a3035201168d98f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"vsmsoui.dll","sha256":"b68124b65c5b1dc2a00867e903606205802a436ffaec18d7b54b2d9fad7a4075","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"msenv.dll","sha256":"1b3c573003a028b1b04674f74a548c042a713b0e5e78a566f4b100276a83f8c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Uninstall.exe","sha256":"07ad0ca3208862029a06bda91d231625226dbf3dd0681443453af8990b916e07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"DBGHELP.DLL","sha256":"7b578fa22e35086c5a200aa2d568d92ae140441680b6ab1a04bccdb1ac1e99e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"SciTE.exe","sha256":"766bc6672e3b828c9dd7190b3971342da690840fd0d74ea9e903728b1cdf1753","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Aut2exe.exe","sha256":"7b629adf293277381697541661eb213768d452217622f1cf9aeac072083838e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Au3Record.exe","sha256":"bc9a0084d81bee854d808a8366383f417ea135e5f9799553a52652c8e6d60aa2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AutoItX3.Assembly.dll","sha256":"80064dacf768e7dfd8a2121b6039d5fd5dcc499f764e0197c913ae8d95ffbada","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Au3Info_x64.exe","sha256":"5a71767bacfc8575be289a5bedc51dd10ee30482dc613b2e7b01e972aab842f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"dexplmnu.dll","sha256":"8a446e905d99903196771a2c368fd8269543da6edd69c281b35cdae9c8cbaeaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AutoItX3.PowerShell.dll","sha256":"58c89e74d112b4618cef6b7789872004905ac5f06c3d112e0a112c673dfaefc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"install.res.3082.dll","sha256":"6674c674e2acfa7a7117e93c66e868b6342c6305eb4e0aa15622ca47daf9303b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"hxvz.dll","sha256":"e59a044bfe847871a5273f59cd50f47144bd5ab39d739ca8b039c8fdf66723ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"armsvc.exe","sha256":"ff8c6949af3d55865ddc25f8a6a3db9f75b4ff8606b08ca7c92f60c5b2fd534c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AdobeARMHelper.exe","sha256":"7a1c5e7c3f055b0e5016fc7add380ac10fd88effe271967efa7ed06b1d643c15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Au3Info.exe","sha256":"50a14e1dc2d9e31eb56de4e49442850481cabba7bef28a2ce8a71068153d369e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"dexplmui.dll","sha256":"df1c0dcf1777f95d9265cb1c3fc0853969b4b217402869ccb55bd1cb15cdc4a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"msenvui.dll","sha256":"005e6d5c671472a78a4367dc6e9dad8bc7acd9250c141dcbd4c99848fd8186cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"PDFPrevHndlr.dll","sha256":"e574cb1fa1b0e1b19816d28c2060a94c56910698a6f372cf61e0ff38a9fbfd27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"dexplore.exe","sha256":"b05ed31d7a2990f375680f0776c375652610499d3a532c868156be914efc8645","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"_Excel4.xls","sha256":"f714a0d43f8d4d444b13732f1a8d24189ed66e916b750ea46a495507b1c02555","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"vrfauto.dll","sha256":"fb59e449da7c96f7643429b3157702c36d59ec4855bbaf42e3275bf2ea088047","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"vslog.dll","sha256":"8cee3d745988b76c7c22c3c2c40581aeacab651c8418d5f01e4eb9867d580353","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"AdobeHunspellPlugin.dll","sha256":"0f947be036f5c8d186a277d5d99c7516f73019ec9b76f71b7f473c1355cca90e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"HH_DEX.MSI","sha256":"8bf3ff3a7cace176ecfa660ad61004c235df90ef40e73226e8e3f04036315246","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"Test.doc","sha256":"456fb656903b12be17ec896ce5a6557d921fe08e83e1957efad8887012f538a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"jaureg.exe","sha256":"f6643d051c23b773751276c27da6cb4a5700b9ed5ffdc41b30f4f4b5afd2e139","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"name":"jusched.exe","sha256":"d165e44ab1bdf83ce00388ef78bc99fabea526932dd0aa77951dafadf1d5871e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80.exe.config","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\System32\\crypt32.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\1508739625696$OK","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\symbols\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%WINDIR%\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80.exe","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\osetup.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.msi","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.msi","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\Failed.txt","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AGM.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\NPSWF32.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\icudt.dll","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm.api","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annots.api","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]},{"path":"C:\\Files.txt","sources":[{"report_type":"sandbox","report_id":"59bcfbdb7ca3e12ec75a3475"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["59bcfbdb7ca3e12ec75a3475"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Paradise.Generic Sample 82cfb70e00f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 82cfb70e00f3…. Malware family: Ransom.Paradise.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Paradise.Generic Sample 82cfb70e00f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 82cfb70e00f3…. Malware family: Ransom.Paradise.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/82cfb70e00f357065b68861e71f04b0af33d77fb63e72997b81c3c0402bf5c80"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Paradise.Generic Sample 82cfb70e00f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 82cfb70e00f3…. Malware family: Ransom.Paradise.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]