26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ca,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Encoder Sample 855f411bd066… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 855f411bd066…. Malware family: Trojan.Ransom.Encoder. Threat score 100/100. 19/25 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808","keywords":["Malicious","Trojan.Ransom.Encoder","malware analysis","sandbox report","threat intelligence","855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808"],"about":{"@type":"SoftwareApplication","name":"99549bcea63af5f81b01decf427519af.virus.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Encoder","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":4,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T17a4,".exe" renamed original file"C:\bootTel.dat" to "C:\bootTel.dat.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\$filehashes$.dat" to "C:\found.000\dir0001.chk\$filehashes$.dat.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest.NEVADA"28:T10c7,".exe" queries volume information of "C:\bootTel.dat" at 00000000-00006476-00000049-1620294 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" at 00000000-00006476-00000049-1770445 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" at 00000000-00006476-00000049-1772142 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" at 00000000-00006476-00000049-1772814 ".exe" queries volume information of "C:\found.000\dir0001.chk\$filehashes$.dat" at 00000000-00006476-00000049-1778975 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest" at 00000000-00006476-00000049-1842197 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" at 00000000-00006476-00000049-1847438 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" at 00000000-00006476-00000049-1886439 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" at 00000000-00006476-00000049-1904005 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" at 00000000-00006476-00000049-1946833 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest" at 00000000-00006476-00000049-1951108 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest" at 00000000-00006476-00000049-1975003 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest" at 00000000-00006476-00000049-2025629 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" at 00000000-00006476-00000049-2035484 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest" at 00000000-00006476-00000049-2047056 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb.manifest" at 00000000-00006476-00000049-2051860 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db.manifest" at 00000000-00006476-00000049-2082902 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24.manifest" at 00000000-00006476-00000049-2124343 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest" at 00000000-00006476-00000049-2124896 ".exe" queries volume information of "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest" at 00000000-00006476-00000049-212617629:Tfdc,"rc_btradiooff.ps1" has type "data"- Location: [C:\found.000\dir0008.chk\rc_btradiooff.ps1]- [targetUID: 00000000-00006476] "ExcelMUI.msi" has type "data"- Location: [C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi]- [targetUID: 00000000-00006476] "rs_temporaryprofile.ps1" has type "data"- Location: [C:\found.000\dir0005.chk\rs_temporaryprofile.ps1]- [targetUID: 00000000-00006476] "vhdmp.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_vhdmp.inf_31bf3856ad364e35_10.0.17134.1_none_7450d89762bf67bb\vhdmp.inf]- [targetUID: 00000000-00006476] "hidbthle.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_hidbthle.inf_31bf3856ad364e35_10.0.17134.1_none_10c33264dc0d30f2\hidbthle.inf]- [targetUID: 00000000-00006476] "msmouse.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_msmouse.inf_31bf3856ad364e35_10.0.17134.1_none_c9127cd775ef8879\msmouse.inf]- [targetUID: 00000000-00006476] "ARM.msi" has type "data"- Location: [%ALLUSERSPROFILE%\Adobe\ARM\Reader_11.0.00\ARM.msi]- [targetUID: 00000000-00006476] "wdma_bt.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_wdma_bt.inf_31bf3856ad364e35_10.0.17134.1_none_7fed5e7ceaf6f330\wdma_bt.inf]- [targetUID: 00000000-00006476] "OfficeMUI.msi" has type "data"- Location: [C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.msi]- [targetUID: 00000000-00006476] "PowerPointMUI.msi" has type "data"- Location: [C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi]- [targetUID: 00000000-00006476] "Proofing.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.0 MSI Installer Code page: 1252 Title: Installation Database Subject: Microsoft Office Proofing (English) 2010 Author: Microsoft Corporation Keywords: Installer MSI Database Release Comments: This Installer database contains the logic and data required to install Microsoft Office Proofing (English) 2010. Template: x64;1033 Revision Number: {04A4A567-234F-4A4B-8A40-D50F80D02ED5} Create Time/Date: Tue Mar 30 17:22:26 2010 Last Saved Time/Date: Tue Mar 30 17:22:26 2010 Number of Pages: 200 Number of Words: 2 Name of Creating Application: Windows Installer XML (3.0.5419.0) Security: 2"- Location: [C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi]- [targetUID: 00000000-00006476] "xboxgip.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_xboxgip.inf_31bf3856ad364e35_10.0.17134.1_none_517c1368f133f239\xboxgip.inf]- [targetUID: 00000000-00006476] "rs_uac.ps1" has type "data"- Location: [C:\found.000\dir0005.chk\rs_uac.ps1]- [targetUID: 00000000-00006476] "urssynopsys.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_urssynopsys.inf_31bf3856ad364e35_10.0.17134.1_none_f1eb87334130843e\urssynopsys.inf]- [targetUID: 00000000-00006476] "bthleenum.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_bthleenum.inf_31bf3856ad364e35_10.0.17134.1_none_9c8f8ab2e226b32e\bthleenum.inf]- [targetUID: 00000000-00006476] "bthpan.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_bthpan.inf_31bf3856ad364e35_10.0.17134.1_none_03fc23c4b916f8c3\bthpan.inf]- [targetUID: 00000000-00006476] "setup.chm" has type "data"- Location: [C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm]- [targetUID: 00000000-00006476] "hidinterrupt.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_hidinterrupt.inf_31bf3856ad364e35_10.0.17134.1_none_3c0d30c6df4b4ed4\hidinterrupt.inf]- [targetUID: 00000000-00006476] "sensorshidclassdriver.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_sensorshidclassdriver.inf_31bf3856ad364e35_10.0.17134.1_none_92a1cf19f639f90a\sensorshidclassdriver.inf]- [targetUID: 00000000-00006476] "vdrvroot.inf" has type "data"- Location: [C:\found.000\dir0002.chk\amd64_dual_vdrvroot.inf_31bf3856ad364e35_10.0.17134.1_none_a18506d29a6abad8\vdrvroot.inf]- [targetUID: 00000000-00006476]2a:T65b,".exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\readme.txt" ".exe" touched file "C:\ProgramData\Microsoft\Windows\Templates\readme.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\readme.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\readme.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\readme.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\readme.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\readme.txt" ".exe" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\readme.txt" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies\readme.txt" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Network Shortcuts\readme.txt" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\readme.txt" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\readme.txt" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\SendTo\readme.txt" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\readme.txt" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\readme.txt"2b:T117e,Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\str\pattern.rs" Heuristic match: "C:\Users\user\.cargo\registry\src\github.com-1ecc6299db9ec823\cipher-0.4.3\src\stream.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\io\mod.rs" Heuristic match: "called `Option::unwrap()` on a `None` value/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "src\main.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\std\src\thread\mod.rs" Heuristic match: "C:\Users\user\.cargo\registry\src\github.com-1ecc6299db9ec823\winsafe-0.0.12\src\kernel\utilities\w_string.rs" Heuristic match: "C:\Users\user\.cargo\registry\src\github.com-1ecc6299db9ec823\rand_core-0.5.1\src\os.rs" Heuristic match: "C:\Users\user\.cargo\registry\src\github.com-1ecc6299db9ec823\base64-0.3.1\src\lib.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\slice\iter.rs" Heuristic match: "()/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\string.rs" Heuristic match: "already borrowed/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\char\methods.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\mod.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\alloc\src\vec\spec_extend.rs" Heuristic match: "library\std\src\rt.rs" Heuristic match: "library\std\src\thread\scoped.rs" Heuristic match: "library\std\src\thread\mod.rs" Heuristic match: "RUST_BACKTRACElibrary\std\src\env.rs" Heuristic match: "library\std\src\io\buffered\linewritershim.rs" Heuristic match: "library\std\src\io\readbuf.rs" Heuristic match: "library\std\src\io\stdio.rs" Heuristic match: "stdoutlibrary\std\src\io\mod.rs" Heuristic match: ":.library\std\src\panic.rs" Heuristic match: "library\std\src\path.rs" Heuristic match: "library\std\src\process.rs" Heuristic match: "library\std\src\sync\once.rs" Heuristic match: "PATHlock count overflow in reentrant mutexlibrary\std\src\sys_common\remutex.rs" Heuristic match: "RUST_MIN_STACKlibrary\std\src\sys_common\thread_info.rs" Heuristic match: "library\std\src\sys_common\wtf8.rs" Heuristic match: "library\std\src\panicking.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "library\std\src\sys\windows\io.rs" Heuristic match: "library\std\src\sys\windows\os.rs" Heuristic match: "library\std\src\sys\windows\path.rs" Heuristic match: "library\std\src\sys\windows\pipe.rs" Heuristic match: "library\std\src\sys\windows\process.rs" Heuristic match: "exeNUL\cmd.execouldn't generate random bytes with fallback RNGlibrary\std\src\sys\windows\rand.rs" Heuristic match: "library\std\src\sys\windows\thread.rs" Heuristic match: "library\std\src\sys\windows\thread_parker.rs" Heuristic match: "library\std\src\sys\windows\mod.rs" Heuristic match: "library\std\src\sys\windows\stack_overflow.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\dbghelp.rs" Heuristic match: "called `Option::unwrap()` on a `None` valuelibrary\panic_unwind\src\seh.rs" Heuristic match: "/rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ops\function.rs" Heuristic match: "C:\Users\runneradmin\.cargo\registry\src\github.com-1ecc6299db9ec823\rustc-demangle-0.1.21\src\legacy.rs" Heuristic match: "C:\Users\runneradmin\.cargo\registry\src\github.com-1ecc6299db9ec823\rustc-demangle-0.1.21\src\v0.rs" Heuristic match: ".llvm.C:\Users\runneradmin\.cargo\registry\src\github.com-1ecc6299db9ec823\rustc-demangle-0.1.21\src\lib.rs" Heuristic match: "library\alloc\src\ffi\c_str.rs" Heuristic match: "a formatting trait implementation returned an errorlibrary\alloc\src\fmt.rs" Heuristic match: "library\alloc\src\str.rs" Heuristic match: "library\core\src\num\mod.rs" Heuristic match: "library\core\src\panicking.rs" Heuristic match: "library\core\src\slice\index.rs" Heuristic match: "library\core\src\str\pattern.rs" Heuristic match: "library\core\src\unicode\printable.rs" Heuristic match: "library\core\src\unicode\unicode_data.rs" Heuristic match: "sys\windows\os.rs" Heuristic match: "l41_v_v.msrtc0nngcttest.com"2c:T639,".exe" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00006476) ".exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\* (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter readme.txt (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter S-1-5-18 (UID: 00000000-00006476) ".exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-18\* (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter S-1-5-21-735145574-3570218355-1207367261-1001 (UID: 00000000-00006476) ".exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\* (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.exe (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter bootmgr (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter BOOTNXT (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter bootTel.dat (UID: 00000000-00006476) ".exe" called "FindNextFileW" with parameter Config.Msi (UID: 00000000-00006476)2d:T17a4,".exe" renamed original file"C:\bootTel.dat" to "C:\bootTel.dat.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\$filehashes$.dat" to "C:\found.000\dir0001.chk\$filehashes$.dat.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest.NEVADA" ".exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest.NEVADA"2e:T46e,".exe" trying to access a file "C:\Users\All Users\MICROSOFT\VAULT\AC658CB4-9126-49BD-B877-31EEDAB3F204\2F1A6504-0641-44CF-8BB5-3612D865F2E5.VSCH" ".exe" trying to access a file "C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" ".exe" trying to access a file "C:\Users\All Users\MICROSOFT\VAULT\AC658CB4-9126-49BD-B877-31EEDAB3F204\3CCD5499-87A8-4B10-A215-608888DD3B55.VSCH" ".exe" trying to access a file "C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" ".exe" trying to access a file "C:\Users\All Users\MICROSOFT\VAULT\AC658CB4-9126-49BD-B877-31EEDAB3F204\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.NEVADA" ".exe" trying to access a file "C:\Users\All Users\MICROSOFT\VAULT\AC658CB4-9126-49BD-B877-31EEDAB3F204\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.NEVADA" ".exe" trying to access a file "C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch"2f:Te59,".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-activesynccsp_31bf3856ad364e35_10.0.17134.1_none_f33b0ddddab62566.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2329316d4a126116.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_c3c945ba3e394044.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cy-gb_bb3b9ffc43d4c527.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-us_0977d25023c68003.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_a470ef7d1b97ee30.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_abfaa53316bf880a.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gl-es_4fcb66ba08d6e883.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kn-in_d9f6d7ffd498e52a.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mn-mn_203304f1b9bb8620.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mt-mt_229b507db83648f0.manifest" with delete access ".exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quz-pe_70168e91317ac39f.manifest" with delete access30:Ta9a,Found string "SetThreadDescription" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNELBASE.DLL) Found string "GetSystemTimePreciseAsFileTime" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNELBASE.DLL) Found string "WaitOnAddress" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNELBASE.DLL) Found string "NtCreateFile" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: NTDLL.DLL) Found string "NtReadFile" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: NTDLL.DLL) Found string "NtWriteFile" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: NTDLL.DLL) Found string "RtlNtStatusToDosError" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: NTDLL.DLL) Found string "NtCreateKeyedEvent" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: NTDLL.DLL) Found string "NtReleaseKeyedEvent" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: NTDLL.DLL) Found string "NtWaitForKeyedEvent" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: NTDLL.DLL) Found string "FlsGetValue" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNELBASE.DLL) Found string "AreFileApisANSI" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNELBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin, API is part of module: KERNEL.APPCORE.DLL)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791651477749,"unified_at":"2026-10-10T16:57:57.749Z","metadata":{"hashes":{"sha256":"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808","sha1":"c7fcbaedf6b077b3d9bfc4720c3860a5d848bcb4","md5":"99549bcea63af5f81b01decf427519af","sha512":"e04530a498d749758a7564b8f6a21f923f61fa723c08179a751d0fd8ec31bb085b54d218256494c555dce0c7b655eec33972dfe9b7f220efc57ce3717a7f6c92","ssdeep":"6144:l5BGdXpsv8yHWjRxmrkwql2yVayc4nP4jcyeO9mrmcFEIos52:/BGQkwkwnyVZHScyz9mCc7","ssdeep_chunks":["6144:l5BGdXp","6144:5BGdXps","6144:BGdXpsv","6144:GdXpsv8","6144:dXpsv8y","6144:Xpsv8yH","6144:psv8yHW","6144:sv8yHWj","6144:v8yHWjR","6144:8yHWjRx","6144:yHWjRxm","6144:HWjRxmr","6144:WjRxmrk","6144:jRxmrkw","6144:Rxmrkwq","6144:xmrkwql","6144:mrkwql2","6144:rkwql2y","6144:kwql2yV","6144:wql2yVa","6144:ql2yVay","6144:l2yVayc","6144:2yVayc4","6144:yVayc4n","6144:Vayc4nP","6144:ayc4nP4","6144:yc4nP4j","6144:c4nP4jc","6144:4nP4jcy","6144:nP4jcye","6144:P4jcyeO","6144:4jcyeO9","6144:jcyeO9m","6144:cyeO9mr","6144:yeO9mrm","6144:eO9mrmc","6144:O9mrmcF","6144:9mrmcFE","6144:mrmcFEI","6144:rmcFEIo","6144:mcFEIos","6144:cFEIos5","6144:FEIos52","12288:l5BGdXp","12288:5BGdXps","12288:BGdXpsv","12288:GdXpsv8","12288:dXpsv8y","12288:Xpsv8yH","12288:psv8yHW","12288:sv8yHWj","12288:v8yHWjR","12288:8yHWjRx","12288:yHWjRxm","12288:HWjRxmr","12288:WjRxmrk","12288:jRxmrkw","12288:Rxmrkwq","12288:xmrkwql","12288:mrkwql2","12288:rkwql2y","12288:kwql2yV","12288:wql2yVa","12288:ql2yVay","12288:l2yVayc","12288:2yVayc4","12288:yVayc4n","12288:Vayc4nP","12288:ayc4nP4","12288:yc4nP4j","12288:c4nP4jc","12288:4nP4jcy","12288:nP4jcye","12288:P4jcyeO","12288:4jcyeO9","12288:jcyeO9m","12288:cyeO9mr","12288:yeO9mrm","12288:eO9mrmc","12288:O9mrmcF","12288:9mrmcFE","12288:mrmcFEI","12288:rmcFEIo","12288:mcFEIos","12288:cFEIos5","12288:FEIos52","6144:/BGQkwk","6144:BGQkwkw","6144:GQkwkwn","6144:Qkwkwny","6144:kwkwnyV","6144:wkwnyVZ","6144:kwnyVZH","6144:wnyVZHS","6144:nyVZHSc","6144:yVZHScy","6144:VZHScyz","6144:ZHScyz9","6144:HScyz9m","6144:Scyz9mC","6144:cyz9mCc","6144:yz9mCc7"],"imphash":"ff3a3d931c8b944178e33a9163f3960f"},"file_info":{"file_name":"99549bcea63af5f81b01decf427519af.virus.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":518144,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1677769209000,"last_seen":1728807461000,"last_multi_scan":1728807461000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["nevada","petya","ransomware"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":28},"sandbox_signatures":{"informative_count":40,"suspicious_count":16,"malicious_count":4,"total":60},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Ransomware/Win.Nevada","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.Filecoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/FileCoder.ezxqy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Encoder.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_Win64_Nevada","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Encoder.B (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win64/Filecoder.HH trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/LockFile.jl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a7a3d1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic.dx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Encoder.jvbfsz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Nevada-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W64.Nevada.518144","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABRansom.OTVE-3138","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Genus.LQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanBanker.Emotet","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win64.53036","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.Encoder","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"suspicious","value":"Contains key cryptographic functions (API strings)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Rename many files (often indicator of ransomware infection)"},{"type":"informative","value":"Rename files"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"suspicious","value":"Rename files with double extension (often done by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Found debugger evasion api strings"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"suspicious","value":"Tries to access a Windows Vault/Credential locations"},{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Imports GetEnvironmentVariable API"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retreive system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Attempts to read Outlook-related files (file access)"},{"type":"informative","value":"Attempts to write Outlook-related files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"malicious","value":"Making HTTPS connections using insecure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Rename files","description":"$27","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"UnhandledExceptionFilter\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]\n Observed api string:\"SetUnhandledExceptionFilter\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found debugger evasion api strings","description":"Observed string:\"IsDebuggerPresent\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retreive system language (API string)","description":"Observed api:\"GetUserDefaultUILanguage\"[Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Observed string:\"FindFirstVolumeW\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]\n Observed string:\"GetVolumePathNamesForVolumeNameW\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]\n Observed string:\"SetVolumeMountPointW\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]\n Observed string:\"FindNextVolumeW\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]\n Observed string:\"FindVolumeClose\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$28","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Attempts to read Outlook-related files (file access)","description":"\".exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-157","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Attempts to write Outlook-related files (file access)","description":"\"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.exe\" writes file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-158","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Desktop\\new\\nevada_locker\\target\\release\\deps\\nevada.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"CreateThread\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SYSTEM\\CurrentControlSet\\ControlError:\"\n \"ServicesPipeTimeoutSYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\nevadaServiceSYSTEM\\CurrentControlSet\\Control\\SafeBoot\\NetworkWinDefendbcdedit{default}safebootnetwork/setFailed to set safe mode!\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate system service (API string)","description":"Observed string:\"OpenSCManagerW\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\__rust_anonymous_pipe1__.","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"%USERPROFILE%\\.cargo\\registry\\src\\github.com-1ecc6299db9ec823\\cipher-0.4.3\\src\\stream.rs\" (Indicator: \"github.com\")\n \"%USERPROFILE%\\.cargo\\registry\\src\\github.com-1ecc6299db9ec823\\winsafe-0.0.12\\src\\kernel\\utilities\\w_string.rs\" (Indicator: \"github.com\")\n \"%USERPROFILE%\\.cargo\\registry\\src\\github.com-1ecc6299db9ec823\\rand_core-0.5.1\\src\\os.rs\" (Indicator: \"github.com\")\n \"%USERPROFILE%\\.cargo\\registry\\src\\github.com-1ecc6299db9ec823\\base64-0.3.1\\src\\lib.rs\" (Indicator: \"github.com\")\n \"%USERPROFILE%\\.cargo\\registry\\src\\github.com-1ecc6299db9ec823\\rustc-demangle-0.1.21\\src\\legacy.rs\" (Indicator: \"github.com\")\n \"%USERPROFILE%\\.cargo\\registry\\src\\github.com-1ecc6299db9ec823\\rustc-demangle-0.1.21\\src\\v0.rs\" (Indicator: \"github.com\")\n \".llvm.%USERPROFILE%\\.cargo\\registry\\src\\github.com-1ecc6299db9ec823\\rustc-demangle-0.1.21\\src\\lib.rs\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2\" at base c64e0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\" file has an entrypoint instructions - \"subrsp, 0x28,call0x140042a38,addrsp, 0x28,jmp0x1400425f0,int3,int3,int3,int3,int3,int3,int3,int3,nopword ptr [rax + rax],subrsp, 0x10,movqword ptr [rsp], r10,movqword ptr [rsp + 8], r11,xorr11, r11,lear10, [rsp + 0x18],subr10, rax,cmovbr10, r11,movr11, qword ptr gs:[0x10],cmpr10, r11,jae0x1400427d0,andr10w, 0xf000,lear11, [r11 - 0x1000],movbyte ptr [r11], 0,cmpr10, r11,jne0x1400427c0,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\conhost.exe\" [Source: 00000000-00006476-00000BC0-67589302]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"\"CreateServiceW\" (Indicator: \"CreateService\"; File: \"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$29","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\".exe\" writes a file \"C:\\found.000\\dir0012.chk\\thumbcache_16.db\"\n \".exe\" writes a file \"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\1ED65FC1-B72C-4159-8CC0-D30471E1FED7\\x-none.16\\stream.x86.x-none.man.dat\"\n \"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.exe\" writes a file \"C:\\found.000\\dir0012.chk\\thumbcache_256.db\"\n \"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.exe\" writes a file \"%ALLUSERSPROFILE%\\Microsoft\\Storage Health\\StorageEventsArchive.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Observed api string:\"WNetOpenEnumW which can Starts an enumeration of network resources or existing connections\"[Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]\n Observed api string:\"WNetEnumResourceW which can continues an enumeration of network resources\"[Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]\n Observed api string:\"WNetCloseEnum which can ends a network resource enumeration\"[Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2b","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetCloseEnum\" which can \"ends a network resource enumeration\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]\n Observed import api \"WNetEnumResource\" which can \"continues an enumeration of network resources\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]\n Observed import api \"WNetOpenEnum\" which can \"starts an enumeration of network resources or existing connections.\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed api string:\"GetDriveTypeW\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindNextFileW\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]\n Observed api string:\"FindFirstFileW\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed api string:\"GetEnvironmentVariableW\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%USERPROFILE%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00006476-00000C10-131613685002\")\n \"%USERPROFILE%\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00006476-00000C10-131627196123\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetEnvironmentVariable API","description":"Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-81","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains key cryptographic functions (API strings)","description":"\"BCryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\")\n \"BCryptGenRandom\" (Indicator: \"BCryptGenRandom\"; File: \"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"dbghelp.dll\" (Indicator: \"dbghelp.dll\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found - (Indicator: \"des\") in Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\n Found - (Indicator: \"base64\") in Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\n Found - (Indicator: \"rsa\") in Source: 855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\n Found - (Indicator: \"des\") in Source: 00000000-00006476-00000C10-14454754480\n Found - (Indicator: \"des\") in Source: 00000000-00006476-00000C10-51802417204\n Found - (Indicator: \"rsa\") in Source: 00000000-00006476-00000C10-60051512879\n Found - (Indicator: \"rsa\") in Source: 00000000-00006476-00000C10-60093764591\n Found - (Indicator: \"rsa\") in Source: 00000000-00006476-00000C10-60497116861\n Found - (Indicator: \"des\") in Source: 00000000-00006476-00000C10-151354369027","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00006476-45121-262-F52D2DE8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"HAPUBWS.dat\" containing the Windows username \"HAPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"31/70 Antivirus vendors marked sample as malicious (44% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"General","name":"Rename files with double extension (often done by ransomware)","description":"$2d","origin":"API Call","mitre_attack_id":"T1036.007","relevance":3,"id":"api-163","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Rename many files (often indicator of ransomware infection)","description":"\".exe\" renames more than 200 files","origin":"API Call","mitre_attack_id":"T1036","relevance":10,"id":"api-164","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access a Windows Vault/Credential locations","description":"$2e","origin":"API Call","mitre_attack_id":"T1555.004","relevance":5,"id":"api-166","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2f","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\" has a TLS callback with entrypoint at 0x400316e0\n \"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\" has a TLS callback with entrypoint at 0x1","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n RegOpenKeyExW\n RegDeleteKeyW\n CreateServiceW\n GetDriveTypeW\n GetFileAttributesW\n WriteFile\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n GetSystemDirectoryW\n TerminateProcess\n GetModuleHandleExW\n SleepEx\n LoadLibraryA\n GetStartupInfoW\n GetProcAddress\n GetSystemInfo\n FindNextFileW\n FindFirstFileW\n FindFirstFileExW\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n WriteFileEx\n GetModuleHandleW\n CreateProcessW\n Sleep\n WNetOpenEnumW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.bin\" has a section named \"_RDATA\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"31/70 Antivirus vendors marked sample as malicious (44% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"level":"malicious","category":"Network Related","name":"Making HTTPS connections using insecure TLS/SSL version","description":"Connection was make using TLSv1.1 [tls.handshake.version: 0x00000302]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":26,"dropped_files_count":0,"extracted_files_count":95,"files_written_count":68,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["nevada","petya","ransomware"],"sample_flags":["Extracted Files","User Comment","Simulated analysis"],"sandbox_reports":[{"id":"6401dca892a28b0ab20498a2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Win64:RansomX","submit_name":"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.exe","analysis_start_time":"2023-03-03T11:41:14+00:00","indicators_count":{"informative":40,"suspicious":18,"malicious":4},"tags":["Extracted Files","User Comment","Simulated analysis"],"is_in_unified_schema":true},{"id":"6401bd1396bb75287b033dc5","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"99549bcea63af5f81b01decf427519af.virus.exe","analysis_start_time":"2023-03-03T09:25:40+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}],"processes":[{"pid":6476,"ppid":0,"name":"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.exe","command_line":"","sha256":"855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808","normalized_path":"C:\\855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808.exe","uid":"00000000-00006476","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABDElEQVR42u2WSwrCMBCGiwgiggjiWRUfoKgLwbVQ8DQiXkHbA/QAfbebkVm0ZpGk07ENgh346a7fN38gxLK66eZX5ng6g8kYE7jdH9KvVMDzPCNRCuR53kqyLCuTpmm9BvAH1vxJThW8UuBiX8uIArODC9O9C5OdC+OtA6ONA8O1A4PVC/rLF/QWHwHbtpVJkoTXAAUuNiDbHOFsAQq8kQZUR0CBY3SbY+I45jVAgRcCugbYAhR4IaDavAjrCChwDIJ1DURRxGuAAi8EVJsjnC1AgWMQ+lUDqiOgRrc5JgzDdq9iWQMivHUB3eZGBVTwIAjqC1Td7VVnLsJZAk3Cfd83+yQjvwm76eZv5w1WzRqWyEpLtgAAAABJRU5ErkJggg=="}],"all_imported_dlls":["kernel32.dll","apphelp.dll","sechost.dll","bcrypt.dll","cryptbase.dll","user32.dll","gdi32full.dll","ole32.dll","KernelBase.dll","advapi32.dll","msvcrt.dll","win32u.dll","ucrtbase.dll","oleaut32.dll","fltLib.dll","kernel.appcore.dll","ntdll.dll","gdi32.dll","msvcp_win.dll","imm32.dll","VxSSL64.dll","rpcrt4.dll","mpr.dll","bcryptprimitives.dll","combase.dll","ws2_32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ARM.msi","sha256":"a880f911cc253d501aec94941c87dbb76c40ea68cfc5dc3ce7420ed73b6df537","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"AdobeARM.bin","sha256":"7f72a8c026d54898d0a396f1a21f472e4c8d2fc5448530862d029fdd2cb91fba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"directories.acrodata","sha256":"c507929257543d426de741f188dcdfb747d8e67b8a222b1d9435c0f6714758e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"AcroRead.msi","sha256":"259096dadab0a17f6e2f3e06e1401067e5a89ced4e5cd95b75119a106ae2110f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"Hx.hxn","sha256":"e79d5b793f8c09a78fc88b4fa009093079e609e7a9e1dae8157907b3fbdf6271","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.EXCEL.14.1033.hxn","sha256":"5d828668f23517b3d8461d2aaf266497ad7efe54f14af2a9f923129ca73a6abf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.EXCEL.DEV.14.1033.hxn","sha256":"e4cac950dbd1538285e29cc716afcd10f2fc6db3ce2d4ae5e98b4774b98af779","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.GRAPH.14.1033.hxn","sha256":"7a77130cf01ebfbf9248c963a1b485e95e37907cc98cd46bffc87732e996b2eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.GROOVE.14.1033.hxn","sha256":"4adf46d0fac1129f5fd65395dd9c7e704b48e826a277ce6f350be434cfe30440","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.INFOPATH.14.1033.hxn","sha256":"436dd39ee9d0976390c4c4cb71cc95fca73e32eb66f546387ef74a9b1749e7ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.INFOPATHEDITOR.14.1033.hxn","sha256":"63225ca8d6f426f08954d0c1472eba392c5e07a9b5213a152696ac6bd50f1a60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.MSACCESS.14.1033.hxn","sha256":"b9c296d6f7a626d47eae4ffaf5b8878ff5fc7f38b2516705460f105ef2bac231","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.MSACCESS.DEV.14.1033.hxn","sha256":"0d6f328a3a2759f46047361681d098dbeda55f503f764b24da7ff1273ba39448","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.MSOUC.14.1033.hxn","sha256":"7379e395796cffbe0209b31add808e74ae81bf384bda0fe70e1a6a3c25bb5152","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.MSPUB.14.1033.hxn","sha256":"4311b13c55fe43424d4bae9df1852bc2a456a65ade860bdfc664a2d03172aa36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.MSPUB.DEV.14.1033.hxn","sha256":"076411088d1135628c64644cfc5bfe5aaac3413fc17117efb413fb4656c66246","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.MSTORE.14.1033.hxn","sha256":"85ef7f2db35bde39d06fdea7d708cc2bc3e60a3a189afd91c5d180ced89f1975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.OIS.14.1033.hxn","sha256":"1c9398aac609ac290b02d1997739bd10cb4b6d94ca1957eb121eb5c06c1faba8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.ONENOTE.14.1033.hxn","sha256":"b88de9732b597e453bcbea64539377df4e91540b6700287894b2d25c4643e4a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"MS.OUTLOOK.14.1033.hxn","sha256":"1a12b5e0f448b8b4196af17f7eb9345a14ecd5a8b85b72fdcfcacea50c64acf6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"naspmodelfileslist.bin","sha256":"0188d12a69391c2cef7db645c0c3fca4a2456dc62fcd31565ced7221296fbe45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"tn1033.bin","sha256":"7226e0b80521807b05aa1410478e930788946c996c35bf38262ffe4ebacfdc65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"naspmodelcurrentversion.bin","sha256":"1b53850c43d67487f068bdaba89754abb233cc3edacbb058ff871e0c7525abb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"vc_runtimeAdditional_x86.msi","sha256":"f4a4bdc54e28f61b48ca3dabe30e31c5ec37bb92812c62b0ec7cda89e95c29cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"vc_runtimeMinimum_x86.msi","sha256":"3fb12c47f96ecba2cc2f1442b48235e78e096a13238fa6d79d149019cd061cc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"ExcelMUI.msi","sha256":"c4a197d5901959b66190b2c9993b101558d83213dc80ce2397427adf6b2ff53d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"PowerPointMUI.msi","sha256":"6a5a229b5d4f1fa078bfd369391b81b764b15617b27c0f8054301508def0b95a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"PublisherMUI.msi","sha256":"2216e939f8a5cc0d7b6d3692a5e9a6f8f5d0473791bd53a05ccfed69fafb335a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"OutlookMUI.msi","sha256":"d5cf2f8b3cdace10b90aa544f6a04fc59f10c9af405bafff7817cd4c71b2e080","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"WordMUI.msi","sha256":"649b4d88f8f504235fcb1a71ea26ab1ceb32674fa2ff8498ace8b9b819e0641f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"Proof.msi","sha256":"01d1937d851f1f64e39e2ba2f87147b6d0c2aad57fbb9277fad2faeed12dbffe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"Proofing.msi","sha256":"9e5b4f6ca90e4b053e8b114ca1299a4831dde1f095a5890ba6d758327c5f87b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"Office32MUI.msi","sha256":"41c15fc8eb0a8cc82b40a21e063c04a7ffa1c09075b55ee7f7c7a535069a19b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"InfoPathMUI.msi","sha256":"600dfd96c1236feec429c9299fd4aa0f0f5f55f92217531c8d110d1b10c4cc0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"OneNoteMUI.msi","sha256":"5d0c1fcbe63934662106b5e2ff443028ab6900cb32fdcb2e20576e0b0f8b1e0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"GrooveMUI.msi","sha256":"f30869e8d87c248599396044f0478e851f846f2f8f23bf03c16ec1449e131547","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"OfficeMUI.msi","sha256":"b180840b2fa66d18e58b6dce9209f4986141046832fd2f4a12e2b49d9497b9b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"OfficeMUISet.msi","sha256":"8b2af323494b975035c1177e840e3811ba6dedf3d86a09ceab1a6fc3cbd55c9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"ShellUI.MST","sha256":"5272faa60b0e3bd880443376c1ed9274b6ef558d8974d472e12fbe2afb57ead6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"pss10r.chm","sha256":"ffa9c0e1d5a4ea153cdc62c1dabf8c22a55c3101a7573e7a8e6dd1e96fd53906","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"setup.chm","sha256":"726f9653fdb6155c8ccaab580875ea7ada0230e3cd9cdd1e4e24d9bffa43a417","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"AccessMUI.msi","sha256":"6a3e68c93402804df68af5dc5a4b8238c5bea054d89960e58c41c89444cc3fdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"AccessMUISet.msi","sha256":"f30f7beb3ba17acfaf6883e034d4598623e2b2274b124735e120682dab78883b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"Office32WW.msi","sha256":"2e9a882078ce2e447c8f921d70fc2d75e092f55f6bd0d540bfa647edef2b0789","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.cat","sha256":"f708e8ae16ad7aef680a662f05ab6e06922bc7ea47f3535011897abdbe694a67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~wow64~~10.0.17134.1.cat","sha256":"09354900adf4df24f66ac0ee04e26eee689323aec3e2e912a7ced0cf51b29637","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"update.cat","sha256":"bd25ebc31b699eef9e80188b7b2a29d96d18f7b6fde9368c0f79786ac8dcae3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"basicdisplay.inf","sha256":"f98f33d7e05ad0795c90322444bcad94cd65636d6f799bed23005270f7c788cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"basicrender.inf","sha256":"96902a1e00b4c4937079745463e5ba261a6f3296e3f78b6580a7f96953b87472","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"bthleenum.inf","sha256":"361a0a0f9eae6672057b57f2e08f2f9fecf0b8fd6e989a69ea1528105eeeb009","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"bthpan.inf","sha256":"f52609504946c70386e0b44b9b97d86649ccfa5e231b61d4bc245254834a50b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"bthprint.inf","sha256":"8ae2e71cd9afc7f2641f2c93974329a90725299323cd4a4e9cbc15555c8ed787","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"buttonconverter.inf","sha256":"d46eb65d2fde5ff478918fbdd8c53111d47c1009bb0197e80d83b982b1b4cbd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"c_barcodescanner.inf","sha256":"c756091dc35b852090f1db44b18c90d899b6a1fb453d53858a84cfafb2b07de4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"c_cashdrawer.inf","sha256":"f330a5011b4436c93e447421f7f14237c617e00b418400dd5a61284e46eb5618","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"c_linedisplay.inf","sha256":"5e1a89c6a3823307c56bb5a405e552645d3476e07a1243080a6bf01ae49e2f92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"c_magneticstripereader.inf","sha256":"b6f15a78910c2d31532ddcd376fe8062549f709bc6e9600c0344526a25a9f806","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"c_receiptprinter.inf","sha256":"30cc7b8d756cf6c60b8295bd45d9e0ce214ba42ac6dc016c1071250e66c9e7d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"display.inf","sha256":"ad24a42f7bd4b00be824cee019ed992d0ccc97ba629cf8385caf80025dacb9b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"fusionv2.inf","sha256":"f2f8c72936289af42b02e28243c662aeb2f4695f873096e0afd02a6c355e7733","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"hidbth.inf","sha256":"7dd96537abad3047a8dbe185f519635a38ed711062ca7296c0f5e3bf5de10bfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"hidbthle.inf","sha256":"d71dfe7ac608cdae9e7674339fbdb77fcb88ccb66c1064058808462e2a185f7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"hidinterrupt.inf","sha256":"fed2f0b79b6be00623dbf79fa9eb2dfce22ea01745ff79eb1c19f0930bd5299d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"hidvhf.inf","sha256":"f58387ab6665864dc11e0653a88223430d9367dfc4ee47d6ce72aad6bc4851f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"idtsec.inf","sha256":"1d66c0b33a80c93ef57db456af0d45a89a8e8a1f0eea60d40c489222fb44d506","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"mgtdyn.inf","sha256":"a69ac283d4665ef928630c235c61a62baac5734d923492490b94e27bca04c5c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"miradisp.inf","sha256":"d9816fa915316b5ebeae1865d1534326ea4f770bb396f302084209507a7a81b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"msmouse.inf","sha256":"5613464102c5b3064a4ebbffa317724a4656da2d72138edaa8581663bf3da4f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"ndisuio.inf","sha256":"830cd93e0ea1dd1188a7ff424800b179f48dad66f8331cf976f7a3cc3fbbd02c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"netnb.inf","sha256":"7d5991d066a59ad28ef9dfad247d5c35b7c99b524c68bb46bae6bcd0e814ddee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"npsvctrig.inf","sha256":"5ac2f3528a84caaa1e35c357c5dbb04305e4ce79d159ba2ceedc5007f60ae1e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"oposdrv.inf","sha256":"1f86ab6919babbd4a69f55bb729ca9d2ff4aaf62e6f7b0eb45768b4ae86d01ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"sensorshidclassdriver.inf","sha256":"49f59872698a13b54d035ffe9417abde71875f7b74149bd0e9724e61cf494adb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"ufxchipidea.inf","sha256":"d0baa25ddb49899db70a8e311100546cd80bb91ad171a43bd8e07134424a8b9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"urschipidea.inf","sha256":"a7c3f0705926918faf1083f95652af19e4e47d4f2ac079cedb2dad6115b8394a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"urssynopsys.inf","sha256":"a54a204869951fe241e5b0bc5c3da22cfb20d8ae4f0a78f41ae01bd2b7d6c3b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"usbcciddriver.inf","sha256":"1a732d1f26737ab0212c5fe7e7920dce25fcb2f96b9f898292829af081f4d886","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"usbser.inf","sha256":"e163c365f1bcf96a6b2d7b400a92880aa6d26c03a489f5f3c16f9d0fc2ef013c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"vdrvroot.inf","sha256":"b7b25a831644c39af638e162aaf2b1a19e94015cde650371899e8a0c550528c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"vhdmp.inf","sha256":"b0086eea549d6ea75aaf214528508a48b49f3bb83666de24f82046748d3513bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"wdma_bt.inf","sha256":"fbbecf25c7ddde45df61ed411dd71701badd5d82642aaaa4b86b20d5b32c250a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"winusb.inf","sha256":"21d32ff2a3ee3bc18998863a9753b28fa074e9af62fa6c134902188fd7e8fd78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"xboxgip.inf","sha256":"1c2e117f92cd48d5516632dadae478aab4bad4f69bed0e717355f2efbb84c35c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"xusb22.inf","sha256":"4d6eaa861033d38cb4f6bb8a18b910a8aa126c12137eb3fec0b2e106654054b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"rs_themes.ps1","sha256":"6f35cc08d16e06e9735df25aba19ad5d2c485d8b2f7693d7d8fe9366b27925ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"rs_transparency.ps1","sha256":"a213db7c91dc8703a9b95d59e720520b56dab3a7e9b79cd1d59fbdb4f84cbc42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"rc_connectedaccount.ps1","sha256":"295b7e382f59c80717e917f104b253235119dd45d947a5365375405d8ee7df48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"rs_temporaryprofile.ps1","sha256":"aeab2de643bfe30685de6e2c9609397cd20cfff8eb1215c03d743042fa3aa99c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"rs_uac.ps1","sha256":"570cc31758fa77d8327eba0b7d944b1650ff96ceb4124cf13bc0f68a5c4fd907","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"cl_invocation.ps1","sha256":"ef82c4c38c55a9c926f4ebc3360a2e07ae0924dd7306a9c99fb6b702dc27a899","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"cl_loadassembly.ps1","sha256":"2b22b4302bb3d43407fc9dea383ea7197c552aa2e82b4ec471dd2559fa2adfb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"rc_bitsdll.ps1","sha256":"1b7d7f133463110c53fdd53a47876538485dbe7bba82d6116a31e34577f23de1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"ts_main.ps1","sha256":"9473b91870134090dc146e3fef42ed1c9ab34b92653ab968bf8277f845ff2d32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"rc_btradiooff.ps1","sha256":"dd6a7d10b67d91fa5c3fb690ab579b0da8a61dd2cb7e1647f23c7932e4e16ffc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"name":"rc_checkbt.ps1","sha256":"63c77c35f3ddf08d7e5e87530a8aa386dd1da226ffa0f3f2d92709ffcab9d8f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]}],"files_written":[{"path":"C:\\$Recycle.Bin\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-18\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\Config.Msi\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\Documents and Settings\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0000.chk\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0001.chk\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_basicdisplay.inf_31bf3856ad364e35_10.0.17134.1_none_15a0a24ecefe2c08\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_bthprint.inf_31bf3856ad364e35_10.0.17134.1_none_e35b5f7602624c2d\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_buttonconverter.inf_31bf3856ad364e35_10.0.17134.1_none_7c47985213344f20\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_c_barcodescanner.inf_31bf3856ad364e35_10.0.17134.1_none_42fc83d78749326c\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_c_magneticstripereader.inf_31bf3856ad364e35_10.0.17134.1_none_8ed26c3e962592c8\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_c_receiptprinter.inf_31bf3856ad364e35_10.0.17134.1_none_c32532b5ff00a6b6\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_hidbthle.inf_31bf3856ad364e35_10.0.17134.1_none_10c33264dc0d30f2\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_hidvhf.inf_31bf3856ad364e35_10.0.17134.1_none_5f058f010856977f\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_mausbhost.inf_31bf3856ad364e35_10.0.17134.1_none_9f648b79c0f9f1c2\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_miradisp.inf_31bf3856ad364e35_10.0.17134.1_none_c7e53ad6db9f67a9\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_ndisuio.inf_31bf3856ad364e35_10.0.17134.1_none_2456c3b1a5c2bb85\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_ufxchipidea.inf_31bf3856ad364e35_10.0.17134.1_none_f5c834ebc9ce7654\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_usbser.inf_31bf3856ad364e35_10.0.17134.1_none_8281fb62ec80df7e\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_usbstor.inf_31bf3856ad364e35_10.0.17134.1_none_264b44d815dcdf50\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_dual_wdma_bt.inf_31bf3856ad364e35_10.0.17134.1_none_7fed5e7ceaf6f330\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-onecore-c..llmanageretw-events_31bf3856ad364e35_10.0.17134.1_none_686962f394b8c021\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0002.chk\\amd64_microsoft-onecore-xamltilerender_31bf3856ad364e35_10.0.17134.1_none_4262b18fcf58db28\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0004.chk\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0007.chk\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\found.000\\dir0011.chk\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\PerfLogs\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\PerfLogs\\Admin\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\Recovery\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"C:\\tempdir\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Adobe\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Adobe\\Acrobat\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Adobe\\Acrobat\\11.0\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Acrobat\\11.0\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Adobe\\Acrobat\\11.0\\Replicate\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Acrobat\\11.0\\Replicate\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Adobe\\Acrobat\\11.0\\Replicate\\Security\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Adobe\\ARM\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Adobe\\ARM\\Reader_11.0.00\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Adobe\\ARM\\Reader_11.0.00\\20606\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\Reader_11.0.00\\20606\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Adobe\\Setup\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AB0000000001}\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Comms\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%ALLUSERSPROFILE%\\Comms\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%ALLUSERSPROFILE%\\Desktop\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%ALLUSERSPROFILE%\\Documents\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Microsoft\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Microsoft\\AppV\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppV\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Microsoft\\AppV\\Setup\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\AppV\\Setup\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Microsoft\\ClickToRun\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Microsoft\\ClickToRun\\1ED65FC1-B72C-4159-8CC0-D30471E1FED7\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Microsoft\\ClickToRun\\1ED65FC1-B72C-4159-8CC0-D30471E1FED7\\en-us.16\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\ClickToRun\\1ED65FC1-B72C-4159-8CC0-D30471E1FED7\\en-us.16\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Microsoft\\ClickToRun\\1ED65FC1-B72C-4159-8CC0-D30471E1FED7\\x-none.16\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Microsoft\\ClickToRun\\69850160-2ED2-47BC-B50E-F0920A5FC735\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Microsoft\\ClickToRun\\69850160-2ED2-47BC-B50E-F0920A5FC735\\en-us.16\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]},{"path":"%USERPROFILE%\\Microsoft\\ClickToRun\\69850160-2ED2-47BC-B50E-F0920A5FC735\\x-none.16\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6401dca892a28b0ab20498a2"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6401dca892a28b0ab20498a2"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Ransom.Encoder Sample 855f411bd066… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 855f411bd066…. Malware family: Trojan.Ransom.Encoder. Threat score 100/100. 19/25 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.Encoder Sample 855f411bd066… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 855f411bd066…. Malware family: Trojan.Ransom.Encoder. Threat score 100/100. 19/25 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/855f411bd0667b650c4f2fd3c9fbb4fa9209cf40b0d655fa9304dcdd956e0808"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.Encoder Sample 855f411bd066… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 855f411bd066…. Malware family: Trojan.Ransom.Encoder. Threat score 100/100. 19/25 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]