21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 9bf104a6e2db… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9bf104a6e2db…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d"],"about":{"@type":"SoftwareApplication","name":"1tasty.exe.bin","applicationCategory":["peexe","executable"],"identifier":"9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T792,Spawned process "cmd.exe" with commandline "/C sc stop VVS" (UID: 00021257-00004036) Spawned process "sc.exe" with commandline "sc stop VVS" (UID: 00021282-00004012) Spawned process "cmd.exe" with commandline "/C sc stop wscsvc" (UID: 00021286-00000828) Spawned process "sc.exe" with commandline "sc stop wscsvc" (UID: 00021309-00001616) Spawned process "cmd.exe" with commandline "/C sc stop WinDefend" (UID: 00021314-00000436) Spawned process "sc.exe" with commandline "sc stop WinDefend" (UID: 00021336-00000352) Spawned process "cmd.exe" with commandline "/C sc stop wuauserv" (UID: 00021346-00002124) Spawned process "sc.exe" with commandline "sc stop wuauserv" (UID: 00021387-00002060) Spawned process "cmd.exe" with commandline "/C sc stop BITS" (UID: 00021392-00001328) Spawned process "sc.exe" with commandline "sc stop BITS" (UID: 00021414-00001756) Spawned process "cmd.exe" with commandline "/C sc stop ERSvc" (UID: 00021421-00002164) Spawned process "sc.exe" with commandline "sc stop ERSvc" (UID: 00021446-00002180) Spawned process "cmd.exe" with commandline "/C sc stop WerSvc" (UID: 00021452-00002192) Spawned process "cmd.exe" with commandline "/C vssadmin.exe Delete Shadows /All /Quiet" (UID: 00021482-00002308) Spawned process "sc.exe" with commandline "sc stop WerSvc" (UID: 00021483-00002604) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00021506-00002384) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} recoveryenabled No" (UID: 00021513-00002284) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00021551-00002260) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00021553-00002316) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00021584-00002564)23:T540,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\oleaccrc.dll" "" touched file "C:\Windows\System32" "" touched file "C:\Windows\System32\cmd.exe" "" touched file "C:\Windows\System32\en-US\crypt32.dll.mui" "" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\_HELP_INSTRUCTION.TXT" "" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\_HELP_INSTRUCTION.TXT" "" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\_HELP_INSTRUCTION.TXT" "" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\_HELP_INSTRUCTION.TXT" "" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\_HELP_INSTRUCTION.TXT" "" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\_HELP_INSTRUCTION.TXT" "" touched file "C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\_HELP_INSTRUCTION.TXT" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\_HELP_INSTRUCTION.TXT" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"24:Tb60,"C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\desktop.ini" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\Default\NTUSER.DAT.LOG1" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\Default\NTUSER.DAT.LOG" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Desktop background.png" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Contacts\desktop.ini" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Contacts\%OSUSER%.contact" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Documents\desktop.ini" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Downloads\01dMtnkBz9.gif" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Downloads\0gakl8ixtWMkw.doc" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Downloads\0Og1.rar" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Downloads\0pYWspjURe8aqA.exe" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Downloads\3Awf.mp3" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Downloads\3dfFyhzUJVQSk.img" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Downloads\4lpro8p6KuJo0.mp3" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Downloads\63sDzrkUoHoRT.exe" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Downloads\6MR6.mp3" for deletion "C:\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe" marked "C:\Users\%OSUSER%\Downloads\6WMjwc1zqk3IB.exe" for deletion25:T44a,"" opened "C:\Users\desktop.ini" with delete access "" opened "C:\Users\Default\NTUSER.DAT.LOG1" with delete access "" opened "C:\Users\Default\NTUSER.DAT.LOG" with delete access "" opened "C:\Users\Default\NTUSER.DAT" with delete access "" opened "C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms" with delete access "" opened "C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf" with delete access "" opened "C:\Recovery\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\boot.sdi" with delete access "" opened "C:\Recovery\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\Winre.wim" with delete access "" opened "C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms" with delete access "" opened "C:\Users\%OSUSER%\Desktop background.png" with delete access "" opened "C:\Users\%OSUSER%\ntuser.ini" with delete access26:T7cd,Spawned process "" (UID: 00019687-00001212) Spawned process "cmd.exe" with commandline "/C sc stop VVS" (UID: 00021257-00004036) Spawned process "sc.exe" with commandline "sc stop VVS" (UID: 00021282-00004012) Spawned process "cmd.exe" with commandline "/C sc stop wscsvc" (UID: 00021286-00000828) Spawned process "sc.exe" with commandline "sc stop wscsvc" (UID: 00021309-00001616) Spawned process "cmd.exe" with commandline "/C sc stop WinDefend" (UID: 00021314-00000436) Spawned process "sc.exe" with commandline "sc stop WinDefend" (UID: 00021336-00000352) Spawned process "cmd.exe" with commandline "/C sc stop wuauserv" (UID: 00021346-00002124) Spawned process "sc.exe" with commandline "sc stop wuauserv" (UID: 00021387-00002060) Spawned process "cmd.exe" with commandline "/C sc stop BITS" (UID: 00021392-00001328) Spawned process "sc.exe" with commandline "sc stop BITS" (UID: 00021414-00001756) Spawned process "cmd.exe" with commandline "/C sc stop ERSvc" (UID: 00021421-00002164) Spawned process "sc.exe" with commandline "sc stop ERSvc" (UID: 00021446-00002180) Spawned process "cmd.exe" with commandline "/C sc stop WerSvc" (UID: 00021452-00002192) Spawned process "cmd.exe" with commandline "/C vssadmin.exe Delete Shadows /All /Quiet" (UID: 00021482-00002308) Spawned process "sc.exe" with commandline "sc stop WerSvc" (UID: 00021483-00002604) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00021506-00002384) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} recoveryenabled No" (UID: 00021513-00002284) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00021551-00002260) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00021553-00002316) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00021584-00002564)27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790344739081,"unified_at":"2026-09-25T13:58:59.081Z","metadata":{"hashes":{"sha256":"9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d","sha1":"42db8e404a9941ba4476d985ff0cc369b579a9c5","md5":"b7083c152a3b8753f51c1d1eb59b9b2b","sha512":"edd42615ee4f34bc08776e7eac2f2b8475fa07a832ef964253d297d5354817c9b99858bf2a0d074367fd331eae78d7a4eb69b48c0b20fe2a0ffbe4c4dc2793ca","ssdeep":"768:K81E5O6Mf++q7a/czZYMHQSO95h/Ibrv3YmC:j1EM6Mf++q7mMG9PIbrv6","ssdeep_chunks":["768:K81E5O6","768:81E5O6M","768:1E5O6Mf","768:E5O6Mf+","768:5O6Mf++","768:O6Mf++q","768:6Mf++q7","768:Mf++q7a","768:f++q7a/","768:++q7a/c","768:+q7a/cz","768:q7a/czZ","768:7a/czZY","768:a/czZYM","768:/czZYMH","768:czZYMHQ","768:zZYMHQS","768:ZYMHQSO","768:YMHQSO9","768:MHQSO95","768:HQSO95h","768:QSO95h/","768:SO95h/I","768:O95h/Ib","768:95h/Ibr","768:5h/Ibrv","768:h/Ibrv3","768:/Ibrv3Y","768:Ibrv3Ym","768:brv3YmC","1536:K81E5O6","1536:81E5O6M","1536:1E5O6Mf","1536:E5O6Mf+","1536:5O6Mf++","1536:O6Mf++q","1536:6Mf++q7","1536:Mf++q7a","1536:f++q7a/","1536:++q7a/c","1536:+q7a/cz","1536:q7a/czZ","1536:7a/czZY","1536:a/czZYM","1536:/czZYMH","1536:czZYMHQ","1536:zZYMHQS","1536:ZYMHQSO","1536:YMHQSO9","1536:MHQSO95","1536:HQSO95h","1536:QSO95h/","1536:SO95h/I","1536:O95h/Ib","1536:95h/Ibr","1536:5h/Ibrv","1536:h/Ibrv3","1536:/Ibrv3Y","1536:Ibrv3Ym","1536:brv3YmC","768:j1EM6Mf","768:1EM6Mf+","768:EM6Mf++","768:M6Mf++q","768:Mf++q7m","768:f++q7mM","768:++q7mMG","768:+q7mMG9","768:q7mMG9P","768:7mMG9PI","768:mMG9PIb","768:MG9PIbr","768:G9PIbrv","768:9PIbrv6"],"imphash":"93e58b2d7c367db3fbbaa0fdbef7f597"},"file_info":{"file_name":"1tasty.exe.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":36352,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1514332092000,"last_seen":1631155526000,"last_multi_scan":1631155526000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":18,"malicious_count":14,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Fury","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Fury","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1123427","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Mole.824DEC5F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Mole.824DEC5F (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.HydraCrypt.L trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.HydraCrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00512adb1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Fury.kq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.cwz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Fury.errngp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.Cryptmix.S1710568","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EUM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Fury.36352","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Fury","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\8E11C52E_offset\"\n \"8E11C52E_offset\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"DBWinMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C sc stop VVS\" on 2017-12-27.00:36:50.602\n \"/C sc stop wscsvc\" on 2017-12-27.00:36:50.882\n \"/C sc stop WinDefend\" on 2017-12-27.00:36:51.173\n \"/C sc stop wuauserv\" on 2017-12-27.00:36:51.513\n \"/C sc stop BITS\" on 2017-12-27.00:36:51.964\n \"/C sc stop ERSvc\" on 2017-12-27.00:36:52.284\n \"/C sc stop WerSvc\" on 2017-12-27.00:36:52.565\n \"/C vssadmin.exe Delete Shadows /All /Quiet\" on 2017-12-27.00:36:52.875\n \"/C bcdedit /set {default} recoveryenabled No\" on 2017-12-27.00:36:53.196\n \"/C bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2017-12-27.00:37:33.596","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$22","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"dskCEJ.exe\" has type \"data\"\n \"yZw6snqBQ28DAzu.exe\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"Tmg2wsFHYf9ioO.doc\" has type \"data\"\n \"EE1D5BA037E314082AB0CB743A2EF694.tastylock\" has type \"data\"\n \"C019CB6232CC45CA65E59D1336CC22E6.tastylock\" has type \"data\"\n \"okbEY.img\" has type \"data\"\n \"_HELP_INSTRUCTION.TXT\" has type \"data\"\n \"400FD9E41852756C52F128D31A7A5720.tastylock\" has type \"data\"\n \"C3197CB23B03097C02D8DBC63CC6E678.tastylock\" has type \"data\"\n \"ZVaaZwpMDt.avi\" has type \"data\"\n \"1629EB7129154A683A689E312AFC2BC4.tastylock\" has type \"data\"\n \"5C16DFE6133FA64F135C466A155C850B.tastylock\" has type \"data\"\n \"98981E16415FF8BCDD9375B54328D5D8.tastylock\" has type \"data\"\n \"73927A2022BA862A156887F0252C6916.tastylock\" has type \"data\"\n \"TCyc7HRP97.img\" has type \"data\"\n \"93896C142C402B2276DAE1922F470A46.tastylock\" has type \"data\"\n \"7ED3DAC01CA4D010B166288C2259B0D4.tastylock\" has type \"data\"\n \"96997D3221E869F5FAC786EE242349C5.tastylock\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$23","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"NTDETECT.COM\"\n Heuristic match: \"ntdetect.com\"\n Heuristic match: \"detect.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00019687-00001212-00000105-50473716","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00019687-00001212-5587-47-003B4CEB","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://ntdetect.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"sc.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\ntuser.ini\"\n \"\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"sc.exe\" called \"OpenService\" to access the \"VVS\" service\n \"sc.exe\" called \"OpenService\" to access the \"wscsvc\" service requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"WinDefend\" service\n \"sc.exe\" called \"OpenService\" to access the \"wuauserv\" service requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"BITS\" service requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"ERSvc\" service\n \"sc.exe\" called \"OpenService\" to access the \"WerSvc\" service requesting \"SERVICE_STOP\" (0X20) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"BITS\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WerSvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"00FF8E11C52E\"; Value: \"\"C:\\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe\"\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"BC8E11C52E\"; Value: \"\"%ALLUSERSPROFILE%\\BC8E11C52E.exe\"\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"*BC8E11C52E\"; Value: \"\"%ALLUSERSPROFILE%\\BC8E11C52E.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 525 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$24","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$25","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe.bin\" claimed CRC 63932 while the actual is CRC 71242","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n GetUserNameW\n RegCreateKeyW\n StartServiceA\n RegOpenKeyW\n RegOpenKeyExA\n CopyFileW\n GetDriveTypeW\n GetModuleFileNameW\n GetVersionExW\n IsDebuggerPresent\n FindFirstFileA\n LoadLibraryExA\n UnhandledExceptionFilter\n LoadLibraryExW\n MapViewOfFile\n DeleteFileW\n GetProcAddress\n CreateFileMappingW\n CreateThread\n GetModuleHandleA\n FindNextFileW\n WriteFile\n FindFirstFileW\n TerminateProcess\n LoadLibraryW\n OutputDebugStringW\n CreateFileW\n Sleep\n GetTickCount\n OutputDebugStringA\n VirtualAlloc\n GetFileSize\n ShellExecuteW\n ShellExecuteExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%ALLUSERSPROFILE%\\BC8E11C52E.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/C bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00021553-00002316)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00021584-00002564)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"43/67 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"43/67 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"/C bcdedit /set {default} recoveryenabled No\" (UID: 00021513-00002284)\n Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00021551-00002260)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00021506-00002384)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_HELP_INSTRUCTION.TXT\" which has been seen in the context of ransomware (Indicator: instruction.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"/C sc stop wscsvc\" (Indicator: \"wscsvc\")\n \"/C sc stop wuauserv\" (Indicator: \"wuauserv\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"System Security","name":"Requested access to a critical system service","description":"\"sc.exe\" called \"OpenService\" to access the \"wscsvc\" service (\"Windows Security Center\") requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"WinDefend\" service (\"Windows Defender\")\n \"sc.exe\" called \"OpenService\" to access the \"wuauserv\" service (\"Windows Update\") requesting \"SERVICE_STOP\" (0X20) access rights","origin":"API Call","relevance":10,"id":"api-79","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"System Security","name":"Sent a control code to a critical system service","description":"\"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\" (\"Windows Security Center\")\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\" (\"Windows Defender\")\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\" (\"Windows Update\")","origin":"API Call","relevance":10,"id":"api-78","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"System Security","name":"Tries to disable/delete the windows firewall","description":"Process \"sc.exe\" with commandline \"sc stop WinDefend\" (UID: 00021336-00000352)","origin":"Monitored Target","relevance":10,"id":"target-18","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe:Zone.Identifier\"\n \"\" checked file \"%ALLUSERSPROFILE%\\BC8E11C52E.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"\"ntdetect.com\"\n \"ntldr\"","origin":"File/Memory","relevance":9,"id":"string-0","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$26","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]}]},"activity":{"stats":{"process_count":21,"spawned_processes_count":21,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":223,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5a42dc977ca3e11cd2775eb6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.Mole","submit_name":"1tasty.exe.bin","analysis_start_time":"2017-12-27T00:35:09+00:00","indicators_count":{"informative":9,"suspicious":22,"malicious":16},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}],"processes":[{"pid":1212,"ppid":0,"name":"9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe","command_line":"","sha256":"9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d","normalized_path":"C:\\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe","uid":"00019687-00001212","icon":"$27"},{"pid":4036,"ppid":1212,"name":"cmd.exe","command_line":"/C sc stop VVS","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019687-00001212","uid":"00021257-00004036"},{"pid":4012,"ppid":4036,"name":"sc.exe","command_line":"sc stop VVS","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00021257-00004036","uid":"00021282-00004012"},{"pid":828,"ppid":1212,"name":"cmd.exe","command_line":"/C sc stop wscsvc","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019687-00001212","uid":"00021286-00000828"},{"pid":1616,"ppid":828,"name":"sc.exe","command_line":"sc stop wscsvc","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00021286-00000828","uid":"00021309-00001616"},{"pid":436,"ppid":1212,"name":"cmd.exe","command_line":"/C sc stop WinDefend","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019687-00001212","uid":"00021314-00000436"},{"pid":352,"ppid":436,"name":"sc.exe","command_line":"sc stop WinDefend","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00021314-00000436","uid":"00021336-00000352"},{"pid":2124,"ppid":1212,"name":"cmd.exe","command_line":"/C sc stop wuauserv","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019687-00001212","uid":"00021346-00002124"},{"pid":2060,"ppid":2124,"name":"sc.exe","command_line":"sc stop wuauserv","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00021346-00002124","uid":"00021387-00002060"},{"pid":1328,"ppid":1212,"name":"cmd.exe","command_line":"/C sc stop BITS","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019687-00001212","uid":"00021392-00001328"},{"pid":1756,"ppid":1328,"name":"sc.exe","command_line":"sc stop BITS","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00021392-00001328","uid":"00021414-00001756"},{"pid":2164,"ppid":1212,"name":"cmd.exe","command_line":"/C sc stop ERSvc","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019687-00001212","uid":"00021421-00002164"},{"pid":2180,"ppid":2164,"name":"sc.exe","command_line":"sc stop ERSvc","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00021421-00002164","uid":"00021446-00002180"},{"pid":2192,"ppid":1212,"name":"cmd.exe","command_line":"/C sc stop WerSvc","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019687-00001212","uid":"00021452-00002192"},{"pid":2604,"ppid":2192,"name":"sc.exe","command_line":"sc stop WerSvc","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00021452-00002192","uid":"00021483-00002604"},{"pid":2308,"ppid":1212,"name":"cmd.exe","command_line":"/C vssadmin.exe Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019687-00001212","uid":"00021482-00002308"},{"pid":2384,"ppid":2308,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00021482-00002308","uid":"00021506-00002384"},{"pid":2284,"ppid":1212,"name":"cmd.exe","command_line":"/C bcdedit /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019687-00001212","uid":"00021513-00002284"},{"pid":2260,"ppid":2284,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00021513-00002284","uid":"00021551-00002260"},{"pid":2316,"ppid":1212,"name":"cmd.exe","command_line":"/C bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019687-00001212","uid":"00021553-00002316"},{"pid":2564,"ppid":2316,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00021553-00002316","uid":"00021584-00002564"}],"all_imported_dlls":["userenv.dll","vssapi.dll","comdlg32.dll","sechost.dll","ntmarta.dll","ieframe.dll","oleacc.dll","gdi32.dll","advapi32.dll","sspicli.dll","iertutil.dll","cfgmgr32.dll","atl.dll","apphelp.dll","KernelBase.dll","usp10.dll","comctl32.dll","crypt32.dll","uxtheme.dll","Wldap32.dll","profapi.dll","kernel32.dll","cryptbase.dll","urlmon.dll","psapi.dll","cryptsp.dll","user32.dll","shlwapi.dll","mpr.dll","rpcss.dll","ntdll.dll","ole32.dll","msctf.dll","propsys.dll","wininet.dll","setupapi.dll","devobj.dll","oleaccrc.dll","shell32.dll","msasn1.dll","oleaut32.dll","rsaenh.dll","winbrand.dll","vsstrace.dll","RpcRtRemote.dll","vss_ps.dll","lpk.dll","msvcrt.dll","rpcrt4.dll","imm32.dll","clbcatq.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"F06C3C509054X0B7D28ZCDDBB17087B9C3E.tastylock","sha256":"0e43473c1322533fcdec8a13e8656f2d781478af9cfef3eda3059da5bd70f7b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"13048f3e3e198c84687c9dd83f2da86e_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"b22cd454b2d03cca1255784d12347a8f69b4156eeb9de0d600d5d2d5cf455836","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"30A877A2136A7E24D444157B15AE5D3C.tastylock","sha256":"4ad6c7d5371d5d7f37e08cd9209518a5c76ee8adad1ba2cb18e1a97583334382","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"31232EC1041B9D9CB641C3FF06A47F54.tastylock","sha256":"f4e712c90cd08bfc4b0d7977d181ccf29ba57788d38ca65e38a790901ccb1593","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"3653CC3D0D93C74C3E8101C1107DA40C.tastylock","sha256":"989ae8435887349a211d4e8b45712f91dbc9a18ae46ae5d386c0279041f3d6ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"54151560298142F0CE86EBF62BAB22A8.tastylock","sha256":"c59edbfec71c84b53736cc69f32daab1e1790fc57fa50d70f9ffd96dfde62259","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"5ABF69D81E581666A4EAB15C2080F86E.tastylock","sha256":"a8bc5f6ca843d4c783647c0d212a6a4e0b5aef0a45eac35d1919a22659557d85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"A8DFD39444EF32307AF75AF7471F15D0.tastylock","sha256":"daf03630a543395d8940af6a7267a8b7aafe6de74c07ec09a66f1460daee0628","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"EEE6CAB210AE50F03129F0DD12F12E98.tastylock","sha256":"88e0542145b57afc6300705a68617a216b1bbab9d768534a1021318bede43e84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"DDA18A102CD1090CEDF75CF02FCAE8EC.tastylock","sha256":"7145b1ea41589498967bf13d12655fdd807a28d3a430fd21025cac32e26a7a58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"CD3D22DA0C0A0607FE29777A0E21E537.tastylock","sha256":"08f6884c312c1c3f59a8eca246ae37f07fea1e12b554078eefa8ab7b5f39bd53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"04156B4A468190D71E3B277249786DAB.tastylock","sha256":"60a8a6198ecb84d69cf3a9bd16f9e8bd233cad763c4add640725d5a7f55bd83f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"0518C25804FDBA10D75324C9099A9B94.tastylock","sha256":"9dd7a1ca4dba86e7a2f6c19c4d3e07354946c6b8946fc3448330bc4b59fcfb5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"067CAA001A4D3B12F9F317001D5B1BFE.tastylock","sha256":"c7848d46f7dff2f3cceb5f110f4f2ad339cfa56f12dc4374f22fda284aae990c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"079B44EE08703F8CE49331050A631C70.tastylock","sha256":"4410c65896216ed233874cb48c2f3278e258d96f88842572c283443dbb38dce4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"096048982E7AA49C61F7283A31348270.tastylock","sha256":"33a1ddb548acd3f16b340e2f5cbf338f4ebcc038d76e0638af6a034fab978961","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"0A9950E432728BD81F7867D534686FF4.tastylock","sha256":"134a9213e11f759c2f7d523b816c764ae44a99324974c14a5e729ec4cda445ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"0C5C173A1164869DD38A82AA13D367D1.tastylock","sha256":"144289ece2da038f0515335a0491cb15d8f7cc9d6fb404007ed89cf701707fa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"13A78AC207FEAFCCE7E9D1660C5D91DC.tastylock","sha256":"3633fe7b8dd8a77a8249cb9c2c3e4e631aae22bf0c89c466675674ac537f3c39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"7f75c745f70a83bd9d49999721aec8bfd980bc184cd07888cbd85dd976253d67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"dH1rDN9f9.doc","sha256":"195e311eb04cd41039c5477b226ce232e40f499f151bf96444a84bbf062101a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"dskCEJ.exe","sha256":"2b40edcc3e4dbee71f2f4cb275f6c78bf59eff3864ece70bf8658c9df201ad03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"730aacf544f49ce6deac4e9155a8ba5caa64ed8918794d4839f97c7242af44a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\en-US\\sc.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%ALLUSERSPROFILE%\\BC8E11C52E.exe","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%ALLUSERSPROFILE%\\BC8E11C52E.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%ALLUSERSPROFILE%\\F06C3C509054X0B7D28ZCDDBB17087B9C3E.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\1514331338081$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\1514331338081$OK","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\tDy.m02","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\psr36dj0okX9p.VsW","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\yz2gELOUh5q24kFsJVJj.cnw","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\1507EDD539533232AA5AF6F33B8A0EEA.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\p4JxAhhxrEU8OwysJi1f8fdh.AGh","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\AD9BBA942BCDD058F4EB5F612DEFB178.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\KeFLhRcse.zJo","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\1ODkci3u3.5gb","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\$Recycle.Bin\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\z4LTDiWR\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\Documents and Settings\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\MSOCache\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\MSOCache\\All Users\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\PerfLogs\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\PerfLogs\\Admin\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%PROGRAMFILES%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\Recovery\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\Recovery\\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\vOJSY\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\System Volume Information\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\Users\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%ALLUSERSPROFILE%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\NTUSER.DAT.LOG2","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"C:\\Users\\F6771DD137E06828717FCBCF3A794944.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\FF811BFC0C67E54B13C2ED8C0F3BC4B3.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\EC05090725539A507C51476D28017A88.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\31232EC1041B9D9CB641C3FF06A47F54.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\3653CC3D0D93C74C3E8101C1107DA40C.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\DDA18A102CD1090CEDF75CF02FCAE8EC.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Favorites\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Links\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Local Settings\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%LOCALAPPDATA%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\NetHood\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Network Shortcuts\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\PrintHood\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Printer Shortcuts\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Recent\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Saved Games\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\SendTo\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\SendTo\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Start Menu\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Templates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Templates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\5ABF69D81E581666A4EAB15C2080F86E.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\30A877A2136A7E24D444157B15AE5D3C.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\AppData\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\54151560298142F0CE86EBF62BAB22A8.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Contacts\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Cookies\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Contacts\\EEE6CAB210AE50F03129F0DD12F12E98.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Contacts\\A8DFD39444EF32307AF75AF7471F15D0.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Documents\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Documents\\My Music\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Music\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Documents\\My Pictures\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Pictures\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Documents\\My Videos\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Videos\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Documents\\Visual Studio 2008\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Documents\\Visual Studio 2008\\Templates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Documents\\Visual Studio 2008\\Templates\\ItemTemplates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Documents\\Visual Studio 2008\\Templates\\ProjectTemplates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Documents\\CD3D22DA0C0A0607FE29777A0E21E537.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\E288690D062145E735230093085D28D7.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\740D207C497F654A24EF72D24BEE42EA.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\C42919BB1072AF471F879D1713B19193.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\517F97902CFB2810B241ACE3307609B8.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\D49718EF437C1731E0898E57476CFA4D.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\C158F086335A6FD0102CC256372A4C6C.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\82E4CEA532042DFB92C9188935A1106F.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\71B63D201AB97A48B96346F81D065C14.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\AA8AB6762715C5E2B5B474E72B0BA866.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\550EC47C1B772C5CC039EDE91F550F70.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\13A78AC207FEAFCCE7E9D1660C5D91DC.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\D62474C8025E141F86EB9E880477F3BB.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\DF8D861C33CC0889B51F61F438E1E691.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\B3990B631238A396169E85F9162C8056.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\56143BAC2395E45CFC35A81925BFC16C.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\AF6A3101052E307F9B8ADD8107F4127B.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\553BF2520B4B6724DFD2930710134498.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\8A09729C0A4F9C00B35B29810E2C7DFC.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\5192D228275CA9EBBCA07AC82D43867B.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\C6F5EA3644B10562785D1F4F4890E5F6.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\6446DE61403C7AEA798A3C3742B15C06.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\B17C37590FDE6815A290B87312ED44CD.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\C306BF623895FB7BC64A08823B8CDBC7.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\9CDDD91731C421E8AE16BA133428FF8C.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\147E750735A064EB8F9850CB395F42FB.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\45AE38AA163314E6F14450F21AFCF8B2.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\858724B72E916EA6994A818330E05036.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\BF567ABC41D786B041BB1DBC441C66D8.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\501AB1C40FC30FEAF692516E144AF29E.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\152170361DD319649205AE1920CAF824.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\9ED11B0633A3A3DF48514A7A378A80C7.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\B7A2DDC71DB38BF7E5C7ECBF2172699F.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\9A62EA9847721CF0168B29E44A46FA54.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\B261228B3443CA7C3EF094473A30ABC8.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\04156B4A468190D71E3B277249786DAB.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\AA6C7F4417C8BA9CA7D906021C939BA8.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\859D81B5246E6C381BFB13E52A7B4F50.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\434DCDFE2488FEABF616A4A226BDDB6B.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\3DD7E1E036A9116475CC296838C3EF34.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\4A27D50038775B44DE4198803AAA3DB0.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\0C5C173A1164869DD38A82AA13D367D1.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\225570301921BEE033C4970A1C089BCC.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\CE96DC9C27BE8F98AB7155CC29D66FF0.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\6E2CBBB525C3BAADC67EA04B28EA975D.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\D03C046E2BB69492E1F4D75B2E037666.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\9332AA0443D1B5A4D5217F0F47C199C4.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\8B876AE321F29C82874B991525477D62.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\9DD9F0C139A90660523E9A6D3BD4E764.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\EE1D5BA037E314082AB0CB743A2EF694.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\73B0301B1EAF06EF9BED795F21DAE9DF.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\067CAA001A4D3B12F9F317001D5B1BFE.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\F62D631F440D68A96A8568FF476646ED.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\C019CB6232CC45CA65E59D1336CC22E6.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\6741F3691042924588F76DCB13827601.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\B3F7403D25342EE78583E73929000C43.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\640B84B700325F5B4DB04C9103473DD7.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\D8E9C11A3E284ECC4808FE8340B12D44.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\43820C9222E94C4E22D2C61B26052EAA.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\30CD8ABE43956F9CBA26774746CC4EE0.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\E902E12C0CB0F37CAD7D57F90F2FD208.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\B3324CE836551768080C223A38FFF56C.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\D772548F09720E6C882F706B0EABED88.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\5786AD312FA221378373747733B20403.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\7ED3DAC01CA4D010B166288C2259B0D4.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\B5344D9406590CD0D634E63F079AEEB8.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\589EA160483E1D18484DDB284A74FBF0.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\079B44EE08703F8CE49331050A631C70.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\8610A2E036683BF8BBA1787439111C94.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\E77466DC34A9E7140EECEC763731CB50.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\13048f3e3e198c84687c9dd83f2da86e_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\871C200C11E1D0140ECB1A1D1535B3C4.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\21C145F423082D6C8DDEE70924D10FEC.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\C8D68CE023719B009DC774A127FB7BA0.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\889F785C455B43A96F226BEC483924FD.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\096048982E7AA49C61F7283A31348270.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\F1A8AC5811072DD8F95922061580110C.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\BDDF461E2380014CE48D9FA92547E1D8.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\E3D184BE44AE2B0088BD1A72470B09B8.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\95865578221D2CC4203D77CC25D00E00.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\3D8781C21E1D8C5ECF2D026320E36922.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\FAB50A101A139BF001C860151DDE7EE4.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\D30A14A84E6CC374CE178FC85250A4DC.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\8CA8E64C2181C43442F852CC25BDA278.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\7E05651D3B9B16B7492FEA834059F347.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\A02BC8A836F48081EA070DD83A346035.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\0A9950E432728BD81F7867D534686FF4.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\554164BE095DDD287180D4E70E3CBCD0.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\56FCE89E3EAE0BD6D52CA0FE4357E8BA.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\777AA1E43CEFD64BD3C7778C3EBFB4DF.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\1DF7FD6C3005ADE037C9BFB332E38AC0.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\91AD55C61846405CD4B7919E1D0E2120.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\6B2572860A26347D64D6C69A0DB5132D.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\A69B3FAE15AB0349F77DBBEE1A16E3BD.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\8EC5FCD0492019C6C7EAB4684D1CFB6A.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\3929E02409CC43A727792C740F5A218F.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\69334F274290F27BEC6967F547E1D3DF.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\EDBD2318351F1401E803393838BEF811.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\944260B5299365661B0966FB2F0E47D2.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\C48960644B8A359A67B5005450C31852.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\73D592301AAA50040D40B88820543054.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\626943122EAB9438164A03CD34CC7674.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\15236645105CA7AFD45BF589122289FF.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\43E79EDD07AC2F266F13152D0B340DBA.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\0518C25804FDBA10D75324C9099A9B94.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\87237D7017F42418908589D81BA40808.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\23BEC0BE2C636B89A7F5407A2E484C59.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\65343E2E11529D6880645CC315CF7D08.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\8AEF6BFD2ABC7F1BCF40C479312A60EB.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\18ACC16815AFAC7C7A4E893C17CF8978.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\DAA1E20434B37FB052C848A6382A60E4.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\E6D57CE300D62E69366DD8B302CB106D.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\CAEF84DD059A1C9180B5C1450845FB55.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\3AD06185034B43C6D1F8CB29087B23B6.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\85F2CBCF160098A1983DD6E919757C11.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\AA24515B0F153D1C4414B0F311042110.tastylock","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"path":"%USERPROFILE%\\Downloads\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\8E11C52E_offset","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"8E11C52E_offset","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a42dc977ca3e11cd2775eb6"}]}]}},"report_ids":{"sandbox_job_ids":["5a42dc977ca3e11cd2775eb6"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 9bf104a6e2db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9bf104a6e2db…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 9bf104a6e2db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9bf104a6e2db…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9bf104a6e2db93cdd52df2ffb772d495ead9ec07de665ca79fc42c1748bf5a9d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 9bf104a6e2db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9bf104a6e2db…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]