24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.GlobeImposter.Generic Sample c1abde82424f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c1abde82424f…. Malware family: Ransom.GlobeImposter.Generic. Threat score 100/100. 1/1 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878","keywords":["Malicious","Ransom.GlobeImposter.Generic","malware analysis","sandbox report","threat intelligence","c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878"],"about":{"@type":"SoftwareApplication","name":"bounty-72627699727064754","applicationCategory":["peexe","executable"],"identifier":"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.GlobeImposter.Generic","antivirusDetections":{"malicious":1,"total":1},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5fa,".exe" read file "C:\Users\%OSUSER%\Downloads\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\ntuser.ini" ".exe" read file "C:\Users\%OSUSER%\Links\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\Documents\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\Desktop\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\Contacts\desktop.ini" ".exe" read file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" ".exe" read file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\compatibility.ini" ".exe" read file "C:\Users\desktop.ini" ".exe" read file "C:\Users\Public\desktop.ini" ".exe" read file "C:\Users\Public\Videos\desktop.ini" ".exe" read file "C:\Users\Public\Videos\Sample Videos\desktop.ini" ".exe" read file "C:\Users\Public\Recorded TV\desktop.ini" ".exe" read file "C:\Users\Public\Recorded TV\Sample Media\desktop.ini" ".exe" read file "C:\Users\Public\Pictures\desktop.ini" ".exe" read file "C:\Users\Public\Pictures\Sample Pictures\desktop.ini" ".exe" read file "C:\Users\Public\Music\desktop.ini" ".exe" read file "C:\Users\Public\Music\Sample Music\desktop.ini" ".exe" read file "C:\Users\Public\Libraries\desktop.ini" ".exe" read file "C:\Users\Public\Downloads\desktop.ini"26:T746,".exe" opened "C:\Users\%OSUSER%\Downloads\35ZarnYhqsU.pdf" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\3CrsgVxPsB.doc" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\3Gy2fs.txt" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\3J2RchD9D4fmlFY.mp3" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\3jKjJFdIAL9.avi" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\3kNG.exe" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\3KtJ69gNAf0RnZU.img" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\3NHgn51R.rar" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\3TXw.exe" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\3VBXaPVG.exe" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\49ZUrTpJop.txt" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\4aSNKoffrEa.rar" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\4atBAsCkzC.avi" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\4SNFg5oLaELI1.jpg" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\59JuNefogVsL0apf.pdf" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\5b9arbo16G.img" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\5Brv3Mn8ExUJfa.img" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\5BYgNUOG.rar" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\5CDRyD7pjBr.gif" with delete access ".exe" opened "C:\Users\%OSUSER%\Downloads\5DvnwUIjh.img" with delete access27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790404350695,"unified_at":"2026-09-26T06:32:30.695Z","metadata":{"hashes":{"sha256":"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878","sha1":"2b89f228cbc071230819546d66759fef8c266c60","md5":"cd092b75804d579ea8ccfab3c9eecb01","sha512":"06098ef77cf7e1dfe5cf5a196f9d317c583a15593d2ff9007e8a99a471cb9b74b2a29ae1b93af6ecb91924ff9b5328bc06b661a32fe958be8136cfb0b4bc97a8","ssdeep":"3072:iey23alnaEIN/Wjw7a0FWez6bf5csRSTNhGNUn:KnaP/WJ0FWvxc+STNg","ssdeep_chunks":["3072:iey23al","3072:ey23aln","3072:y23alna","3072:23alnaE","3072:3alnaEI","3072:alnaEIN","3072:lnaEIN/","3072:naEIN/W","3072:aEIN/Wj","3072:EIN/Wjw","3072:IN/Wjw7","3072:N/Wjw7a","3072:/Wjw7a0","3072:Wjw7a0F","3072:jw7a0FW","3072:w7a0FWe","3072:7a0FWez","3072:a0FWez6","3072:0FWez6b","3072:FWez6bf","3072:Wez6bf5","3072:ez6bf5c","3072:z6bf5cs","3072:6bf5csR","3072:bf5csRS","3072:f5csRST","3072:5csRSTN","3072:csRSTNh","3072:sRSTNhG","3072:RSTNhGN","3072:STNhGNU","3072:TNhGNUn","6144:iey23al","6144:ey23aln","6144:y23alna","6144:23alnaE","6144:3alnaEI","6144:alnaEIN","6144:lnaEIN/","6144:naEIN/W","6144:aEIN/Wj","6144:EIN/Wjw","6144:IN/Wjw7","6144:N/Wjw7a","6144:/Wjw7a0","6144:Wjw7a0F","6144:jw7a0FW","6144:w7a0FWe","6144:7a0FWez","6144:a0FWez6","6144:0FWez6b","6144:FWez6bf","6144:Wez6bf5","6144:ez6bf5c","6144:z6bf5cs","6144:6bf5csR","6144:bf5csRS","6144:f5csRST","6144:5csRSTN","6144:csRSTNh","6144:sRSTNhG","6144:RSTNhGN","6144:STNhGNU","6144:TNhGNUn","3072:KnaP/WJ","3072:naP/WJ0","3072:aP/WJ0F","3072:P/WJ0FW","3072:/WJ0FWv","3072:WJ0FWvx","3072:J0FWvxc","3072:0FWvxc+","3072:FWvxc+S","3072:Wvxc+ST","3072:vxc+STN","3072:xc+STNg"],"imphash":"ba2ce247fa49357770ce28f139e2f1ab"},"file_info":{"file_name":"bounty-72627699727064754","file_type":["peexe","executable"],"file_type_id":"exe","file_size":98816,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1572486641000,"last_seen":1654117769000,"last_multi_scan":1654117769000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware","criminal","crypt","downloader","filecoder","pscrypt"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":5},"sandbox_signatures":{"informative_count":6,"suspicious_count":13,"malicious_count":6,"total":25},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.GlobeImposter.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1063","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameW@SHLWAPI.DLL at 00565302-00001160-46186-33-00409C57\n PathFindFileNameW@SHLWAPI.DLL at 00565302-00001160-46186-117-004096D7","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00565302-00001160-46186-11-00402765\n GetProcessHeap@KERNEL32.DLL at 00565302-00001160-46186-14-0040274B\n GetProcessHeap@KERNEL32.DLL at 00565302-00001160-46186-58-00402779\n GetProcessHeap@KERNEL32.DLL at 00565302-00001160-46186-60-0040278D","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"1LoWM7zNlVq8h.exe\" has type \"data\"\n \"QOLdjWn5hr5.exe\" has type \"data\"\n \"SrO3gl0EN9SPZi43.doc\" has type \"data\"\n \"dSTEZHvd.doc\" has type \"data\"\n \"3TXw.exe\" has type \"data\"\n \"h8fg9WRouk.doc\" has type \"data\"\n \"SETUP.CHM\" has type \"data\"\n \"OCXh75SGcr7.doc\" has type \"data\"\n \"airappinstaller.exe\" has type \"data\"\n \"dsYny5bq4UJV.doc\" has type \"data\"\n \"yDT9O.exe\" has type \"data\"\n \"TTjDpaUqzIMaB0g.doc\" has type \"data\"\n \"RKnV.exe\" has type \"data\"\n \"vaY7qXwkU.exe\" has type \"data\"\n \"Kty1hE.doc\" has type \"data\"\n \"Install.exe\" has type \"data\"\n \"Ho7euGVfWh.doc\" has type \"data\"\n \"securitypack.jar\" has type \"data\"\n \"winupdt.vbs\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Microsoft.NET\"\n Pattern match: \"http://meyerweb.com/eric/tools/css/reset/\"\n Pattern match: \"http://meyerwe\"\n Pattern match: \"b.com/eric/tools\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"COMODO\" (Indicator: \"comodo\")\n \"Kaspersky Lab\" (Indicator: \"kaspersky\")\n \"McAfee\" (Indicator: \"mcafee\")\n \"Avira\" (Indicator: \"avira\")\n \"Avast\" (Indicator: \"avast\")\n \"Symantec\" (Indicator: \"symantec\")","origin":"File/Memory","mitre_attack_id":"T1063","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00565302-00001160-00000105-4264944057","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .rdata with unusual entropies 7.21401385843\n 7.21401385843","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"HAPUBWS-PC-20171203-1827.log\" containing the Windows username \"HAPUBWS\"\n Found dropped filename \"HAPUBWS-PC-20171204-1724.log\" containing the Windows username \"HAPUBWS\"\n Found dropped filename \"HAPUBWS-PC-20171203-1827a.log\" containing the Windows username \"HAPUBWS\"\n Found dropped filename \"HAPUBWS.contact\" containing the Windows username \"HAPUBWS\"\n Found dropped filename \"HAPUBWS-PC-20171203-1827b.log\" containing the Windows username \"HAPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"$25","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"H5uM4HShGf.doc\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%LOCALAPPDATA%\\c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"Your files are encrypted!\" (Source: How_to_open_files.html, Indicator: \"files are encrypted\")\n \"Your files are encrypted, and currently unavailable.
\" (Source: How_to_open_files.html, Indicator: \"files are encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 849 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.bin\" has an entrypoint in section \".rdata\"\n \"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe\" has an entrypoint in section \".rdata\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n RegOpenKeyExW\n CopyFileW\n GetModuleFileNameW\n GetDriveTypeA\n GetFileAttributesW\n GetTempFileNameW\n GetFileSizeEx\n CreateThread\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n ShellExecuteExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\".exe\" created file \"%LOCALAPPDATA%\\c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/20 Antivirus vendors marked sample as malicious (70% detection rate)\n 55/69 Antivirus vendors marked sample as malicious (79% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/20 Antivirus vendors marked sample as malicious (70% detection rate)\n 55/69 Antivirus vendors marked sample as malicious (79% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"62/81 Antivirus vendors marked dropped file \"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe\" as malicious (classified as \"DeepScan:Generic.Ransom.GlobeImposter\" with 76% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\\c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"\"ntldr\"","origin":"File/Memory","relevance":9,"id":"string-0","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":18,"dropped_files_count":0,"extracted_files_count":119,"files_written_count":72,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware","criminal","crypt","downloader","filecoder","pscrypt"],"sample_flags":["Extracted Files","User Comment"],"sandbox_reports":[{"id":"5dba3df1028838ae6c76c8be","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DeepScan:Generic.Ransom.GlobeImposter","submit_name":"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe","analysis_start_time":"2019-10-31T01:50:49+00:00","indicators_count":{"informative":6,"suspicious":15,"malicious":7},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}],"processes":[{"pid":1160,"ppid":0,"name":"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe","command_line":"","sha256":"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878","normalized_path":"C:\\c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe","uid":"00565302-00001160","icon":"$27"}],"all_imported_dlls":["advapi32.dll","rpcrt4.dll","cryptbase.dll","msctf.dll","KernelBase.dll","shlwapi.dll","imm32.dll","ntdll.dll","kernel32.dll","msvcrt.dll","sechost.dll","shell32.dll","user32.dll","usp10.dll","cryptsp.dll","gdi32.dll","lpk.dll","rsaenh.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe","sha256":"c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"How_to_open_files.html","sha256":"e93e2fb5b075e0877f55a16027c45938d1849dba7816612aab04351f9652de0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"InstallTime20171128222554","sha256":"cd3d5467526ac389001e9ff403aae9199ce3578b3ebf8f76dcd166c7c98adc75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"SiteSecurityServiceState.txt","sha256":"72e5a96ffeaf60e2fd13041f8143a90f4e343c526f014b4d9365e158537c162c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"addonStartup.json.lz4","sha256":"3badc748fc7921e8356ca85803d1f983df57a0d39232277f2e10f27b5a2dd0f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"blocklist.xml","sha256":"be9a8046c5a84236ee27b76af8355a57cc74c644d57694f1ebb141b9f5977ac9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"addons.json","sha256":"5387d23ac9f85a5bbe5c6381f073c219b91402947f904b0adbd7b898154661c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"plugins.json","sha256":"8780932f2c5a1a9f78031afaa9114a548a23d0ab49a27c06e2127dc73227fad3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"cert8.db","sha256":"51681e7e62d08f1e4b27de19d4a9c9c89834d5db7d9e215a5cbf2693476908b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"compatibility.ini","sha256":"1398bcc4da1d0478109ef9f7f89c93345e9c3c807304bcd68fad054ce9c68655","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"containers.json","sha256":"cc0e5294ee0ac90d9ac90899ef8ee9665207f1b1418a1b71e6e7df78579f2c0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"content-prefs.sqlite","sha256":"6a415faf17b29827ff706330c532c51c264715221d5da3adc2085ee5380b65ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"cookies.sqlite","sha256":"5e96d54f5a1c6992d6bff8b267232893773ce194ada530bf5bc23aa047695daa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"store.json.mozlz4","sha256":"ef89cfdb12825cd9e4d8bd33d06a2dd81b4c4e3087fc3f8c3541221ad44ce5b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"1553126195477.e56eee61-e3c8-4ddd-954c-bd1c78648206.main.jsonlz4","sha256":"3f81d36a9c0ec65ceae9d41cd127baa4fe88bc0022a1ea9547d87b6db725e051","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"1553184648668.a70cbaeb-a803-4e31-88ab-e9fd64d307a5.main.jsonlz4","sha256":"a3fd61f6fec873a393d5684a002c8351f980d788c8fffcc9429a1974fa4b86c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"session-state.json","sha256":"e8ebf017173c3d9c23988d950d877edf2e4204bd174ed5ae6131bb53268f6216","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"state.json","sha256":"66f6ba8a13e490b2a0b45272245ab0d057e4de28e9783691664dab99a1b0a5cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"extensions.json","sha256":"39f9d4a001a575cacbd5f9569fe6a57eb27c7aad16fddfac2066a84f8b9a2a75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"gmpopenh264.info","sha256":"b18ec409b94b564e4afb204841e2211a516f8a5a8f65d3409ec91b8583c06907","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"LICENSE.txt","sha256":"26f7c088021377be995ec2469c700925d6a5ebfee88faa594837779cd2d169b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"widevinecdm.dll","sha256":"ce21b684e4f8cfe7060bd5ba2080a6e7b865e024764b6993b484389a6cb90039","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Acrobat Reader DC.lnk","sha256":"453818e777d3a5f8f8d85fcb1ceedfc52af8dbb68301f62eadb35ed911fe28a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"0YdED8h4YnKljVf.doc","sha256":"40da279b509341d6d641aba601dca5a6c7a025e35b246c307ac298311c8a6c08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"1LoWM7zNlVq8h.exe","sha256":"9ca9aaa76bf79fdcf258f8af32763ac1d61f2cecde734de3b702366e033a633d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"3TXw.exe","sha256":"7e555b6ef80a1daf2d2c341ca1e91110f6176b51cd95190bc0f79695dab69f26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"3VBXaPVG.exe","sha256":"c06f80514c3fa9bc04a7d9038d52087dce7dbda1b55169587eb03ac9436a22f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"3kNG.exe","sha256":"5c8aa74115bb21c093714e0cbaa67b12c193494261e1e55821f0554ca18bb24e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"6JQvD1.exe","sha256":"137b3cee9d447b2b1578faf6b463f4a65cc0c81095bfe06d47aa9c24490acd57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"7GXTVgCwg.exe","sha256":"12cab654196ec9aede75cff88bb0b7c771a6a792e4382969c1a0ab1d1d77a1b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"A6a4k093.exe","sha256":"d6aa6c5ef63e6c5d95c3448e11e48166d0fc3c78ac763bce90ff6d8c9eb9a77a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"AMrt2OL.exe","sha256":"f20e38381782a68642a11621ccf3093bbb77bede8a51d576a00325c740c1e0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Byf3DiB7aX.doc","sha256":"c7bf4aea1b246e8ee1d87445561d997229f4b0a7b5c5f55cec1e9b08dffef97a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"CJ8ZksCqfYdg3Ha.exe","sha256":"d089ef524cce6dd9a99921e86519d7baf1255ab1c44a53c03408a080ca9eb06b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"CspyTJgM.exe","sha256":"c7d6bdc80409b2d0c66bce6163df364e2fa4730f56068bb8e31de09935d05cd4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"D1JACuX.exe","sha256":"74f6b05715db94520fe4343296baf3744e34443b55406ac8e0c8db8ec27bb19c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"DP001GCJ.doc","sha256":"b2da64811c8fe50059d7cf3da2110eb4ec06ef8c400528add13a56e2c48a6967","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"DcNNjRAkEraNbP.doc","sha256":"fc38a7a788c330a35895d831da9234d27dc4c17a86e3215d25bf92b4fdd52f68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"E68SD0Ky01dhTr.exe","sha256":"5ce5bcc737a1d4ae12bdbc93effae5af27c85f085239c64d22a5064f0e00b3db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"EW9C2p.exe","sha256":"8e70ba09664a39e73747aa04d571756b49dd866f21f26b08221ca1887041686e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"EatIg.exe","sha256":"3ad7095bfcf21a3e9d266974044e21f0f327ee4aa6ec0435f4aca37403d94518","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"F3ECcNeSSZh2HHk.doc","sha256":"454249ca2f3e1f49f6d6d7123524c23eb38809625fc6bf4c02e105ee2539179f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"FjTsWkpkM.exe","sha256":"a258ec6dd6bfd909db4b1a40f7fda6fea20fd6be5b6eb42d4178a8af3088f7ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"GuVY23qj2s4Td.doc","sha256":"e34a3ea0c45f76148bcd2d9e1dfaf536ddd564d050dfbf34c1c8ab2e1b3490cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"H5uM4HShGf.doc","sha256":"0fc1afcd326c4d08c95f641a944b42af32fdde8b13e03f07d6534849045a0d7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Ho7euGVfWh.doc","sha256":"d68b0c05409f2bc974d9a2c7da384fbc4f31205dd742144c6b467d39e592c76e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"HyhkV7STqOqjMtk.exe","sha256":"6adb38ec20fe46d756265dc03b1a8e38996c18ab19be178c35e58a382fc74428","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"IOR7TqkslejAq91.doc","sha256":"9019e23dfaf4faad5459932770906131d04853c1f46a5398c40f1747a3102d1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"KQNwhwsYVN.doc","sha256":"4fd8eb4f7a763053f18aa671811c6f42e954f2b7e764c6948786d14f39eceaf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Kty1hE.doc","sha256":"ef0445cd12c181db4bd8d3ddd1f522c4e7632c111439738bec2be06ef917a089","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"L8yloyiM6okRPgbd.doc","sha256":"65b3783ca1cadb7597b6a8e865d4dc4b501a4a6cb170b053408458f3aa3720aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"MCLvMmDoz8.doc","sha256":"071237dbf6c2a6f7cc91812f39f1ec26a2f170eaa015577e0583ecef7bf93599","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"OCXh75SGcr7.doc","sha256":"72fcb58231312bc721724b2e3ecd5c5075432f7e3c84155b0357088e043afe42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"P7FflJbOH.exe","sha256":"d07aed28f60250688925b461889110a4460aacd789bb27ebd6382d2c334ffc9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"PaGnOfAFV.doc","sha256":"f7efe1e6c1b117e76466454020fcab5498df08fe951c6d731fd7c491d5c6ccb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"QHqsY0rsfcKBMQe6.exe","sha256":"44969e6b6cdadf7734d0cff25cce9855136dac4306bca56dfd1428e079240009","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"QOLdjWn5hr5.exe","sha256":"002a596dc5f500b20dd15654113e043cf8a1ee14403302dbe62c1846eddafa31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"QZ0gLvBKm.exe","sha256":"be58767e701cbb1d8949ccb80b0de654c83866a6383aebf9abe8e7967b1f8d03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"QwHQtYTLWgvQ.doc","sha256":"e88ccef4c0d7f6e85ca59d15bb79f6a4e9493bc9c9a9427bdff753dff7fd3f7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"RKnV.exe","sha256":"4714d19a119d398b1ef7a049bd686f6bc873f23ee242ddc31fd70224dc83fcfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"SrO3gl0EN9SPZi43.doc","sha256":"e323b1b855970459c48cdb69ec0280627d50336864195e8a2e4dfa5ba35f7d7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"SvUAzGFIQ9qYfc.doc","sha256":"37dad4ae45c2d66b4ab6b259dff8bbcbb83dcd47d8af843441691cb8430767a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"THQujKln.doc","sha256":"8f4ac598dc97e9a716162294c0d95179859e09ae20328bffb6e95251e17fc025","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"TTjDpaUqzIMaB0g.doc","sha256":"217c7ce957164cdb93e0428a3d47c6e4301bc82d9ca6b5c55d0ccd95c775b320","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"VjguKL.exe","sha256":"7d065a1a032b92e84543585ae7e5d46bc81d007c40f0be618031a8338005f19f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"WHJUHaHxBnS.doc","sha256":"07d36ada250b76eebc620f7d272dbf541aa6d2b92f436a275e5752a6a8c7d481","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"WbaQ7e.exe","sha256":"d5e6a3411db8bec9512943a25382f05ef385a1535abbc1406fc6022d3c7c6c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Y17hACr8qg.exe","sha256":"8ae3afb226989c78a9c98920b2f966b3e9abc05c87f092eacb6da1e43d239134","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"YfkuO.doc","sha256":"03c90b17800c07227d7b3ab5e3a6a1a8d017c536c70ba2694f91235ed490b3a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"YjmF.exe","sha256":"cbcdf635a7c6e451c8aed8ff025efb9a58ade3bcec12600e8d0a3d690bc0e99d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Z68C2t.exe","sha256":"1f71f976b7a285813a80e165e8cdec82fb38a1ac22892e50041a16256d2dde1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"ZUwXv.doc","sha256":"dde20ef9f295a2b62a4135540a17ad41561517cf062cc37364797cbdbff6423d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"ara0UGGW3VRU.exe","sha256":"6f14e5773f177f279909f1a0c4f9fd1d5aaa93bdb7d3828c9a4be95b49df9616","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"cUJpjDsZO.doc","sha256":"002563707ae81d82960aa95c69a6dea5bbc3201334aa4ae42acfc91b3b67b3c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"dSTEZHvd.doc","sha256":"4c9a8ef54aab053e1fbb3dd635d399d80a87981b5666222f5926242f3c18ac12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"dsYny5bq4UJV.doc","sha256":"0b90ab432fec9fb4ff4c24a982c0462234043db6d11a917e88d54246112a3aa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"fxlTZfcB.exe","sha256":"eeebd24d0877f0aef18146b5d46a8ea253ff686c2e8a04027a3c7b7bd94321f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"g5pB3.exe","sha256":"dc1b8178a4e4d28a12012827b10b2e050fa24354b11038f9d7a7a9de59a915ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"gBiUJ4TRATi57.doc","sha256":"8ae416aba8e2def03cc4e09bf77d430026324949f47f741c569ea5a75bd3588c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"giDj6Q.doc","sha256":"14f20f68b1592f9c5ccbfe989b0cca99938422e7946d9abacdfa83eb9b51fcfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"gmSsIkVXD.exe","sha256":"498f92b367544ad51e37d1956ff949b9d1bb99f026f573374e12d8781278ed1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"h8fg9WRouk.doc","sha256":"186466a5a4e969e178aae61ac411e25c37499b6f8cf42cf996e6303feeb6d914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"hgUOm8vUl.doc","sha256":"a7df81c7cebeef86f3f62de5903cb78c39147171d4d504f274ddf8335bef4b23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"jLgQj5MNMjfkAYq.exe","sha256":"7ecffb386cd2a89755cdbafd49ee38886d3e7ea778f6ff6b7ee5a8f4513f519c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"jR4UhePpkWKtU.exe","sha256":"ada06bf68df498e002c714b54d3703a7ef0cc020c05c8e48592c923bb8065a6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"kM4aPm1y.exe","sha256":"d80a4fc0028b19b735fafb2712a0955d58cbfdf1b2b3a0dae4f958b5a8930604","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"lKxIrwOivZM.doc","sha256":"39c394d6c12439cdddac8fdcd188f8909f375515a31a66fa79677e24e781b77a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"mgF1qbnPMDZnVB.exe","sha256":"34b31a48971130887f5c3374084af9b9d3ecabde4718609b6c503048d68c309a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"oBqqx89Mp9N.doc","sha256":"f5a5e66bcda75815528492ec8652036cd31454e5bbe24e97bf93e330c2dd13f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"ppGWUpWSWorQZ.doc","sha256":"a9a2fb011eda0c06cba900d2166f415cd1474aab8a48d4f8c3c54f25f3eb0180","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"rcKxZC.doc","sha256":"d89d0b57ba1fda2300adf396934f5003f131c10c2d73b6253cb68f1b3272d01f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"sIz9IMypdNES8St.doc","sha256":"944202d31aad9f82bcb27fbb7b46214f373f269acf144cbf2c63c83e7a7e4b9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"uqmgQd.exe","sha256":"12dfa4fa83816afbe8635518d12ff5e85b8be50d09c8f66c7d99f85d4a9c77ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"vaY7qXwkU.exe","sha256":"718087ba864ca973db3ee458f8533d45391fbfa3dfb85c3040a52f4974e36a8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"vsKespazw6mjoz.exe","sha256":"f57d6cdc970180c28a99bf5e6687b01d5aa75ba7df2854c35939d9322d6c1f51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"wSLQ.exe","sha256":"e2046a99747bc7f442127079a042715ed281869406641b3ba2229a64cb674de3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"xH1o63B9xkJUw.doc","sha256":"6d79e291cb961004a1aa6ece0e10b7ccb2501e4072235c89584a26999c6ea261","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"xUCCh60Kqg2.exe","sha256":"cc0c2025a7defc404cb642495c523ebefc6fec224c7b36a0c9cbf87229a56927","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"yDT9O.exe","sha256":"9f73b177ad4aa24deaa7fba9110821877d2acfba5c512a9d41f3cb47c02e1cd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"zIjQMqSEj24HleX.doc","sha256":"c16a6a07c6d8d27642c0b6066a37bedad4289e54a686fe8468f16fe7b0236c59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Desktop.lnk","sha256":"92aaa2144dcda5da8c3b2dd2614751f0d6bfe8a925bd64f2f59309e09dac5c8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Downloads.lnk","sha256":"5a87f3fdcfcb5bc1b2aaecc4feb843e21600483b940bff9a49f20430b69cb643","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"OneDrive.lnk","sha256":"431a518db6c45f9871c7dfda961d4253e1de524c9cb15a911d651883d6302f29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"RecentPlaces.lnk","sha256":"0423cf8f2017eb4ec5de98992bc168b8ddce7e506279d4410823e6d2910f37fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"autoexec.bat","sha256":"f9cf5470b777e45d6736e8234b1dd54b8b3abe8ec966d0618c707dfaef6b524d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"SETUP.CHM","sha256":"045da8767deac1a93e6ffd3463bd173751d7b36c1477f17ae017b5b8e27e1a7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"airappinstaller.exe","sha256":"4ad0e1d5f799a195e65798efb517c5453d94b876c5769bd6e22a2230b6d32efd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Install.exe","sha256":"c78acba3254a22e6fe3e082aef8fdefd89d1ce3d85e85e9d0b919b658c133309","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"securitypack.jar","sha256":"2a314ad12bb3c47253627dd08f9975eddf4e8a15dbffb046c1bd013e5ca4d6e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"winupdt.vbs","sha256":"ca9a8069c2b67a8b02dce264d258a4e4afb61b179620f721cd3b1bf1f26ef497","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"vcredist_x86.exe","sha256":"2ed307ec313aa2d33c40f5a27e669bc7ea166625d4abb4ed4dd4da45cc3cf345","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Activator_Office.exe","sha256":"c7f6fb2a244813c2797818fcd68a511a5f44d278c2ada8dd7baf24996a600595","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Hancom_Office_2010_SE_English_Edition_3PC_1User_Downloader.exe","sha256":"9c8166cef0a3e59db27d90937b80cae99c4eb9ad444afd6fb14906382f2fe270","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"OSETUPUI.DLL","sha256":"265bbf3eb60512376be097868341689e911a9c5bc531b23fc849f424179a02b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"ose00000.exe","sha256":"af9805a87adc18c7aacd9794868cb890e9f9b4abdfc026fc535c822454f94abb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Hancom_Office_2010_SE_English_Edition_3PC_1User_Downloader_1_.exe","sha256":"3db77c682325142d1b798d12e067bd7f60b8552aed50752587b67810d22325b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"AUTORUN.INF","sha256":"5bb60bdc4a7da03ed0f50ce12f9cefb2529a56e70712053f0f3b28d737cb036e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"WindowsInstaller-KB884016-v2-x86.exe","sha256":"31e6c1fd995b8e99b184504935a9085d56340d9fd64966a79ea65b8d9a7014e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"name":"Setup.exe","sha256":"0757bd4e3895fa7497bacf21d42905f6df708077094d2e9a7ed072b51fc1484e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"C:\\c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%LOCALAPPDATA%\\c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"C:\\c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%LOCALAPPDATA%\\c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\60339F329D15C7461297CF24F5234EF1085F9615707C1778276C27D75BEC54AE","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"C:\\share\\1572486665392$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"C:\\share\\1572486665392$OK","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Desktop\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Links\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Documents\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Documents\\hancom\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Documents\\Amazon Downloader Logs\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Desktop\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Contacts\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Wireshark\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\AlternateServices.txt","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\parent.lock","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\SecurityPreloadState.txt","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\temporary\\https+++www.google.com^privateBrowsingId=1\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\about+newtab\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\about+newtab\\idb\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\storage\\default\\about+newtab\\idb\\3312185054sbndi_pspte.files\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\sessionstore-backups\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\gmp-widevinecdm\\1.4.8.1008\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\gmp-gmpopenh264\\1.7.1\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\datareporting\\archived\\2019-03\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\crashes\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\blocklists\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\datareporting\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"C:\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"C:\\Users\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Videos\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Recorded TV\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Pictures\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Music\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Libraries\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Downloads\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%PUBLIC%\\Documents\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Videos\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Searches\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Saved Games\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Pictures\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\OneDrive\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Music\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Favorites\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]},{"path":"%USERPROFILE%\\Downloads\\How_to_open_files.html","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5dba3df1028838ae6c76c8be"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5dba3df1028838ae6c76c8be"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.GlobeImposter.Generic Sample c1abde82424f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c1abde82424f…. Malware family: Ransom.GlobeImposter.Generic. Threat score 100/100. 1/1 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.GlobeImposter.Generic Sample c1abde82424f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c1abde82424f…. Malware family: Ransom.GlobeImposter.Generic. Threat score 100/100. 1/1 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c1abde82424fda25878f0ede45e5fec9c4cfe51207dffa3037f66ec6e6759878"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.GlobeImposter.Generic Sample c1abde82424f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c1abde82424f…. Malware family: Ransom.GlobeImposter.Generic. Threat score 100/100. 1/1 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]