26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Crypren.Generic Sample c267ef56e9c3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c267ef56e9c3…. Malware family: Ransom.Crypren.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27","keywords":["Malicious","Ransom.Crypren.Generic","malware analysis","sandbox report","threat intelligence","c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27"],"about":{"@type":"SoftwareApplication","name":"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27","applicationCategory":["peexe","executable"],"identifier":"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Crypren.Generic","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1141," HOW TO DECRYPT YOUR FILES

Your personal ID

75 64 DB C2 46 72 99 84 BB 3E CB 14 6B 27 69 5D
CE FB 3B 92 56 8D 6E 51 74 06 F7 44 30 A3 CD 14
0C DB 69 E6 8E A4 05 CF 9D 72 EE 46 64 E2 DB 3F
EF 79 98 97 A3 ED A5 D2 69 9D 3F 17 A6 A9 CD 6A
BB 67 D0 C9 25 76 5C 7B 86 67 A5 A7 43 A4 13 7F
3A 9C DB 64 6D E8 23 4A 6C C4 58 DE 73 8F 8A BC
93 7C B7 A7 96 2D 30 42 2F 2B 06 23 6C 31 8B 5B
09 6A 81 99 98 B6 47 AE 9B D7 A5 AE 47 18 1A 5F

... !!! !!! -->

All your important data has been encrypted.

To recover data you need decryptor.

To get the decryptor you should:

pay for decrypt:

site for buy bitcoin:

Buy BTC on one of these sites

https://localbitcoins.com
https://www.coinbase.com
https://xchange.cc

bitcoin adress for pay:

1GvgRRnLpUP7KsLZLE23ridD45MUxHoAJ4

Send 2 BTC for decrypt

After the payment:

Send screenshot of payment to 511_made@cyber-wizard.com. In the letter include your personal ID (look at the beginning of this document).

After you will receive a decryptor and instructions

Attention!

No Payment = No decryption
You really get the decryptor after payment
Do not attempt to remove the program or run the anti-virus tools
Attempts to self-decrypting files will result in the loss of your data
Decoders other users are not compatible with your data, because each user's unique encryption key

" (Source: how_to_back_files.html, Indicator: "decrypt your files") "HOW TO DECRYPT YOUR FILES" (Source: how_to_back_files.html, Indicator: "decrypt your files") "" (Source: how_to_back_files.html, Indicator: "files are encrypted")28:Taa1,"C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "C:\1494357593991$OK" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "C:\autoexec.bat" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "C:\config.sys" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "C:\Users\desktop.ini" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\desktop.ini" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Videos\desktop.ini" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Videos\Sample Videos\desktop.ini" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Videos\Sample Videos\Wildlife.wmv" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Recorded TV\desktop.ini" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Recorded TV\Sample Media\desktop.ini" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Pictures\desktop.ini" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Chrysanthemum.jpg" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Desert.jpg" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Pictures\Sample Pictures\desktop.ini" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Hydrangeas.jpg" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Jellyfish.jpg" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Koala.jpg" for deletion "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Lighthouse.jpg" for deletion29:T6a5,"" opened "C:\1494357593991$OK" with delete access "" opened "C:\autoexec.bat" with delete access "" opened "C:\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe" with delete access "" opened "C:\config.sys" with delete access "" opened "C:\Users\desktop.ini" with delete access "" opened "%PUBLIC%\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\Sample Videos\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\Sample Videos\Wildlife.wmv" with delete access "" opened "%PUBLIC%\Recorded TV\desktop.ini" with delete access "" opened "%PUBLIC%\Recorded TV\Sample Media\desktop.ini" with delete access "" opened "%PUBLIC%\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "" opened "%PUBLIC%\Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Desert.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Koala.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Lighthouse.jpg" with delete access2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790444018134,"unified_at":"2026-09-26T17:33:38.134Z","metadata":{"hashes":{"sha256":"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27","sha1":"656fce925df4896677a3ce8e7e05ff2f049fc6c1","md5":"fbdafc0722f9aa94872b9cf8f2a9087b","sha512":"a99310f64269e9c97684cbbe39086190092c21d14ddd974f7bc0a5acb68e304814f8d167aaecfe4134a494b1fae805f633f1b8854cd4686fa5365b2405e706d0","ssdeep":"3072:eog8WT5G0nGhHpyYfJU0P6Xx23PeGXxXBmJ5F:SGBfKj43FX2JP","ssdeep_chunks":["3072:eog8WT5","3072:og8WT5G","3072:g8WT5G0","3072:8WT5G0n","3072:WT5G0nG","3072:T5G0nGh","3072:5G0nGhH","3072:G0nGhHp","3072:0nGhHpy","3072:nGhHpyY","3072:GhHpyYf","3072:hHpyYfJ","3072:HpyYfJU","3072:pyYfJU0","3072:yYfJU0P","3072:YfJU0P6","3072:fJU0P6X","3072:JU0P6Xx","3072:U0P6Xx2","3072:0P6Xx23","3072:P6Xx23P","3072:6Xx23Pe","3072:Xx23PeG","3072:x23PeGX","3072:23PeGXx","3072:3PeGXxX","3072:PeGXxXB","3072:eGXxXBm","3072:GXxXBmJ","3072:XxXBmJ5","3072:xXBmJ5F","6144:eog8WT5","6144:og8WT5G","6144:g8WT5G0","6144:8WT5G0n","6144:WT5G0nG","6144:T5G0nGh","6144:5G0nGhH","6144:G0nGhHp","6144:0nGhHpy","6144:nGhHpyY","6144:GhHpyYf","6144:hHpyYfJ","6144:HpyYfJU","6144:pyYfJU0","6144:yYfJU0P","6144:YfJU0P6","6144:fJU0P6X","6144:JU0P6Xx","6144:U0P6Xx2","6144:0P6Xx23","6144:P6Xx23P","6144:6Xx23Pe","6144:Xx23PeG","6144:x23PeGX","6144:23PeGXx","6144:3PeGXxX","6144:PeGXxXB","6144:eGXxXBm","6144:GXxXBmJ","6144:XxXBmJ5","6144:xXBmJ5F","3072:SGBfKj4","3072:GBfKj43","3072:BfKj43F","3072:fKj43FX","3072:Kj43FX2","3072:j43FX2J","3072:43FX2JP"],"imphash":"7619ceb786fba65d6b9beea58587b98d"},"file_info":{"file_name":"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27","file_type":["peexe","executable"],"file_type_id":"exe","file_size":134656,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286951000,"last_seen":1677389768000,"last_multi_scan":1677389768000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["vdul","ransomware"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":12,"malicious_count":4,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1223664","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Crypren.0733CD29","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Crypren.0733CD29 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.FV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00518fab1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DelShad.ci","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXBF-HI!FBDAFC0722F9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.enqaxw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.B802A95F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.B802A95F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.4883","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Crypren.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 46316-1069-00413DB6\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014224-00003208-51194-98-004160F4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014224-00003208-51194-13-00414071\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014224-00003208-51194-422-00413DB6\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014224-00003208-51194-234-00413C57","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00014224-00003208-51194-246-00413B45","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 46316-1093-00418BB0\n GetProcessHeap@KERNEL32.DLL at 00014224-00003208-51194-73-00409B8F\n GetProcessHeap@KERNEL32.DLL at 00014224-00003208-51194-100-00409DDE\n GetProcessHeap@KERNEL32.DLL at 00014224-00003208-51194-438-00418BB0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Desktop\\source\\unicode\\a1lock\\Release\\a13lock_final.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\qfjgmfgmkj.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00014314-00003296)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"EXPTOOWS.XLA.vdul\" has type \"data\"\n \"how_to_back_files.html\" has type \"HTML document UTF-8 Unicode text with CRLF LF line terminators\"\n \"BD21348_.GIF.vdul\" has type \"data\"\n \"Essential.xml.vdul\" has type \"data\"\n \"FiveRules.potx.vdul\" has type \"data\"\n \"HM00114_.WMF.vdul\" has type \"data\"\n \"GRAPH_COL.HXT.vdul\" has type \"data\"\n \"Civic.thmx.vdul\" has type \"data\"\n \"J0280468.WMF.vdul\" has type \"data\"\n \"J0106020.WMF.vdul\" has type \"data\"\n \"BD10336_.GIF.vdul\" has type \"data\"\n \"gcroot.h.vdul\" has type \"data\"\n \"ExecutiveMergeLetter.dotx.vdul\" has type \"data\"\n \"J0115876.GIF.vdul\" has type \"data\"\n \"Chess.exe.vdul\" has type \"data\"\n \"J0285444.WMF.vdul\" has type \"data\"\n \"DGCINFO.XML.vdul\" has type \"data\"\n \"dictionary.rfc4818.vdul\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\vssadmin.exe\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Microsoft.NET\"\n Pattern match: \"https://localbitcoins.com\"\n Pattern match: \"https://www.coinbase.com\"\n Pattern match: \"https://xchange.cc\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.82782418653","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00014224-00003208-51194-28-00413EB6","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00014224-00003208-51194-71-00409EA6\n FindResourceW@KERNEL32.DLL at 00014224-00003208-51194-68-00409FE9\n FindResourceW@KERNEL32.DLL at 00014224-00003208-51194-149-00409F12","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$27","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$28","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesA\n GetDriveTypeA\n FindNextFileA\n GetTempPathA\n WriteFile\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n LoadLibraryA\n DeleteFileA\n GetStartupInfoW\n GetProcAddress\n GetFileSizeEx\n FindFirstFileExA\n FindFirstFileA\n FindFirstFileW\n CreateFileW\n CreateFileA\n LockResource\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleW\n CreateProcessA\n FindResourceW\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe.bin\" has a section named \".gfids\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"38/60 Antivirus vendors marked sample as malicious (63% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"38/60 Antivirus vendors marked sample as malicious (63% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"38/60 Antivirus vendors marked spawned process \"\" (PID: 3208) as malicious (classified as \"Gen:Variant.Razy\" with 63% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00014314-00003296)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":27,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":111,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["vdul","ransomware"],"sample_flags":["Extracted Files","User Comment"],"sandbox_reports":[{"id":"59121634aac2ed484ba8085b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Razy","submit_name":"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27","analysis_start_time":"2017-05-09T20:19:34+00:00","indicators_count":{"informative":11,"suspicious":15,"malicious":6},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}],"processes":[{"pid":3208,"ppid":0,"name":"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe","command_line":"","sha256":"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27","normalized_path":"C:\\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe","uid":"00014224-00003208","icon":"$2a"},{"pid":3296,"ppid":3208,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00014224-00003208","uid":"00014314-00003296","icon":"$2b"}],"all_imported_dlls":["imm32.dll","vss_ps.dll","KernelBase.dll","usp10.dll","msvcrt.dll","shell32.dll","rpcrt4.dll","advapi32.dll","msctf.dll","apphelp.dll","ole32.dll","oleaut32.dll","cryptbase.dll","rsaenh.dll","atl.dll","vssapi.dll","clbcatq.dll","RpcRtRemote.dll","user32.dll","lpk.dll","cryptsp.dll","vsstrace.dll","ntdll.dll","kernel32.dll","gdi32.dll","shlwapi.dll","sechost.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"how_to_back_files.html","sha256":"1c3f335ff08a06f854403a7174581245600eada054fb8903420c8ace3a54bb9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"Chrysanthemum.jpg.vdul","sha256":"54c355f7071d0076ca09fcd8ee521ff0dc8936bb838dc66bdebe582c5776f8d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"Desert.jpg.vdul","sha256":"54e135ed5836bb2e9a877caef4b71658710038923324282160149496d8826f87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"Hydrangeas.jpg.vdul","sha256":"a64c7e0b642bea3785891678cc2cd42db26b4d5cb07e85aa5163dc343d66b474","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"Desktop background.png.vdul","sha256":"4a2377c61d62714b73eb4670281666fe6fb95d6b406b7e7f1db4253f96c0bd96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"GobiernoUSA.gov.url.vdul","sha256":"b795845e94a68b302c26df835ef3bc84049998ed2159518fb856349625f097af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"IE site on Microsoft.com.url.vdul","sha256":"973734dfd466ce52638088296ca921f82f600c74cfaef09b61539a9ab3dd7969","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"Get Windows Live.url.vdul","sha256":"e1e30a576e215b3ba4f3255f4c3b6b3e0df1bb2ea7a292cae265e2d067f5a583","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"Desktop.lnk.vdul","sha256":"99b4dc01667a024668438f0ef46edcd81575e3fc51b66c54f8f1299692c6850f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"1494357593991$OK.vdul","sha256":"84854da2aec89892d86a04fda145aeea5798b511c768cf8938c65a203a8f7285","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"autoexec.bat.vdul","sha256":"01698c7a2957904b7b23adc08a6468430fbe082a17cf382d2d2ccca1c858604f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe.vdul","sha256":"c01d8c5bad33a445656c94a48e44802237da97997f43b9694d9dcf1d43e89407","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"config.sys.vdul","sha256":"b30ae1bdcbb51c4401e85f190e0816ed3ecbdf5b68a47e84944ed87636fa3d9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"EXPTOOWS.XLA.vdul","sha256":"9170f7c3aae3a2ffcf5af3562527bf990fb06e2a2e69b7f5ba36f35c84004738","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"BD21348_.GIF.vdul","sha256":"3aa0be6eaa558914e6d40d17d7f8ce700e247bc1ae4ff575bc303d6afde1951f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"Essential.xml.vdul","sha256":"5077e68d8ce7a5555dd571811a57dab4f0cde69541a87c36be298185155c123b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"FiveRules.potx.vdul","sha256":"4c30034772549d2b2279934a3f35ccd51d28a80d6cb81e3bdedd15f89b4e12a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"HM00114_.WMF.vdul","sha256":"e156aa0ac601ea967bce074b19b72083a6b176d22192afbc002914fcb956f31d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"GRAPH_COL.HXT.vdul","sha256":"89bb05571e835f527ea8cf638739445683ac36b340f49ce9eb351fa0d9f1b8a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"name":"Civic.thmx.vdul","sha256":"48a260416e0be1b5feec39c008f357dc20413a6d3ecb8792e73474b0a07e0c94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]}],"files_written":[{"path":"%TEMP%\\qfjgmfgmkj.tmp","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%SAMPLEDIR%\\network.pcapng","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%SAMPLEDIR%\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\1494357593991$OK.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\PU8.bvx","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\autoexec.bat.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27.exe.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\config.sys.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\hc2WKcOkEKQNz.9BI","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\1zrGfl2BNaZ2ML5ptENw.D1D","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\YIr6Sdb4sQe9r71WAiuTR2H7.PK3","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\uR5rtJqto.OU5","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\FncZNwD9k.tLy","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\Users\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"C:\\Users\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Videos\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\Wildlife.wmv.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Recorded TV\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Recorded TV\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Desert.jpg.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Hydrangeas.jpg.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Jellyfish.jpg.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Koala.jpg.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Lighthouse.jpg.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Penguins.jpg.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Tulips.jpg.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Music\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Kalimba.mp3.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Sleep Away.mp3.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Libraries\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Libraries\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Libraries\\RecordedTV.library-ms.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Downloads\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Downloads\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Documents\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%PUBLIC%\\Documents\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Desktop background.png.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\ntuser.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Searches\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Searches\\Everywhere.search-ms.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Saved Games\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Links\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Links\\Desktop.lnk.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Links\\Downloads.lnk.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Links\\RecentPlaces.lnk.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Get Windows Live.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Gallery.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Mail.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Spaces.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Autos.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Entertainment.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Money.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Sports.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSNBC News.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\IE Add-on site.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft At Home.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft At Work.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft Store.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\desktop.ini.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\GobiernoUSA.gov.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\USA.gov.url.vdul","sources":[{"report_type":"sandbox","report_id":"59121634aac2ed484ba8085b"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["59121634aac2ed484ba8085b"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Crypren.Generic Sample c267ef56e9c3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c267ef56e9c3…. Malware family: Ransom.Crypren.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Crypren.Generic Sample c267ef56e9c3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c267ef56e9c3…. Malware family: Ransom.Crypren.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c267ef56e9c39807ad52167d97698994125d9d16fc805e4c80c670149de86b27"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Crypren.Generic Sample c267ef56e9c3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c267ef56e9c3…. Malware family: Ransom.Crypren.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]