26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.KeyPass.Generic Sample ee9f2533600c… — Score 75/100 — Hybrid Analysis","description":"Malicious verdict for sample ee9f2533600c…. Malware family: Ransom.KeyPass.Generic. Threat score 75/100. 15/29 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485","keywords":["Malicious","Ransom.KeyPass.Generic","malware analysis","sandbox report","threat intelligence","ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485"],"about":{"@type":"SoftwareApplication","name":"360F1EC8899F3A8CC13F9B78E8688EF77089F4FE.exe","applicationCategory":["peexe","executable"],"identifier":"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485","additionalType":"Malicious sample"},"threatScore":75,"malwareFamily":"Ransom.KeyPass.Generic","antivirusDetections":{"malicious":15,"total":29},"behavioralIndicators":{"malicious":3,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T497,"" touched file "C:\Windows\System32\oleaccrc.dll" "" touched file "C:\windows\123.txtt" "" touched file "C:\windows\12322.txtt" "" touched file "C:\windows\12344.txtt" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\cDO9C6V\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Windows\AppPatch\pcamain.sdb" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db"28:Tb18,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAIF0lEQVR42t2Xd3BU1xXGN9QJJINTsCcDjI1NIBljkhEDIYARBlMMtixaMAQjAzaYYiyKwWBwwIBkUwMWRcKiCERvAiQkUNQLCCRWaIW0KmjVy67KarXaXbb8cvR2BgyDwYnhj2Rn7rz79p53vu+c+51z31Op/pd+Z0arUPv3RhvkSWHwm+QHvc6tzb2JntGaZwZ64E8qARxFdeQCTNfXYtVswp67Bad2M44cP2yZX9CUOh/DpckUBQ8k1kf1dMh4qlTkBY2mPnW14pCq41B1AiqOQtkhKNkHuj1QtAPubITCDbhyPqcpaQYlBwYTNuInEIme3pbqS/NwFAVDzVmolFF1XsYF97XlvlzIlAoRXZCQ2CnX3e55yS7I+5L6qAmo/9H1PyeRsKgrdQnLBOgY1F2SEQWGK9CUJvMkmceCPhqqIyQbZ9wkyg5DvdjWip0hUtblf90mmhMnk/PNiz+eRNTMttTHLxbnAm4IQx+3muyQj8gK+QTdhRXYqwS8OVuIpMp6vNgJaHWYEDlOWfgiNCHz0Rz6hIqoFULsoGTGD0vsWNRrfvtkEotkm6vDP5DU7leMdWfmcf3UNgry8ykurUBzLY5bx1Ziq0wREnkSsWSkNgGXbMftAz5kRB2hqKiEIl0pmbHnyTvpi6twG9yeizGsP9HTn6CJgsA3cOZvkYiOUpe4moyLQRhtPPDT6UooiJL9thaDMQvMGZSEL0OTEo31e3YWJ+RmqqmM8gWtjKujKAt6+YcJnBirwpiwQNImqi7bR+6ZFVQbGhVnBoOBiIgIKsrLlfv89DjMxaIFqw57eSSaC1sVQJfLSVxcHHl5eW4SDrFNCMGZNgWujcJ83oP0pb94NInCwIG4cr+SEHdxN3sz+fGHkOcVZ15eXvTp04eOHTsSExODxdyIQRsDzgoaboWguxlLo8nM7Nmz8fDwoE2bNuzYsUMhUV6YQ1Osl2RgOPboAZTs7PZoAvqLf5Na/lpZbFb7oUu/pDjw9fXFz8+PyMhIZa1fv37K/0pfsBdRm/4d5hode4MP4OPjg1qtpnv37sp6o8mEsaERU/x7kDIU+5UB6A/2IGzSQ1oIH9eapoRZULBBVLsda+Y6dGnnFKBly5bRtWtXhgwZojw0cuTI+wSs2dSnB2GuKiB4fwidO3dmypQptG/fnnbt2klWmmg0mmhOmQpJQ7BF9qfhSE9uLu/wIIFb61/CmjZbxPKlkNiES7uR4sT92Bzu/W+JusWuV69e3L59W5lbWirBmIpVe5AydTRmi41hw4Ypa61atWLPnj3K3FBRgCNlDK6EIVjD+9J4tCe56zo9SCAvoDf2Gx+BtFHy1kPxdvRJflRW1txTdXFxMU6nU5nrK+7gqpGGUyMNqvIkZcmBmJodylpGRoZUik6Zm6SCGrTST5IH4YgZTPP5P9N45BXy/Z57kMCd3a/hTJf61yyS2lktWdiIM9ef8hvHqW20Y3e4FIc2u4Ab6rFU/Eu6pGxRxWkhcEwOp82UZsVh+l4dtsz1lTocaaKtZE/uXh6A+UxvjIdeIn/DwxnY3hP7NSmVrLmQvVRIrBFByomX409N9llqKssEuBZDVRGWMhFneaiU6hHp+Qfdvb/4WyyZa6nOiaKmugq93kBtyVXupouuUt/AEe+ppN904g/U7+si7js+pIF1L2BNlFLJnCkk5guJz4REix6+VoY9P4C7RQdw6QIFTPpE8XcCLPOiADkBpdPli12ekM5aiD1ziYxP4fo4pfZdycPd0Z99DePhl9HveR7NyvYPVYGURVPUMFCLWtUz4NY8IbFENPGFCFN6Q76/EPlGwLa4AQu3yv1mN7B2nZBd5c5cljQytWxluqQ97V2JfiT22MFYLnpgOt6L+v3dqPznc9z4tNWjewEZ3u7yuilOMueIJha6s5Gz0q0N7Vr3yF3rjrhAsnRbTk2NRHzrYzf5dNnKNG+l9TriRPmX+tF0+lUaQrpTG/g8Or8O7HzzMWcCae/AjUki52nicKbbcUtkLSDZckpqZGiXcff6TOoujBaiH4qNVFDG+/JcS+ReSuSOeKl7AVdSH/oKtXt/h35HJ7KWP+HVjWsjZO/ekj30djvM+Dvc9HGTUYuoNHNoThiHZpsnmqA5aL/ti/PGRLGdIM+NkY43HEfs6/fAG4/0oC64C/qAX1Pu357gcY+JPnvDC9yN+gvOxKESxQi3w5aIro8XAAFJnywRT6U0dCxWo9F9UGmSMJwaJCQn4pSGY48ZijWiP+bTvZWabwGv2fkbarb8HPWSnz0++r6SgDsB999enFI+rmQRZ+ooNxHJiOvq29RdC7hX7y2tqS56Ds7UcdjivLBEjcAcNhDjsd4C3o2agF9RvaUDhatb8fnAH/GOuPiv940sUru2K4Owx4mgkr1xXp0sbdWb5px9DxAwpy4V8Ik0R0+gKWIMjWc8qQ/1QL+3B9XbOlHyVStCJ/+XL6jN4UOwXH4La8x4bAlTsSVOw3ZdSs5hcRNoyKM5fgbmGB9Ml6dgvOBN/amR1B4ehD7w95Rs6MC593/ia7o5YjTmK+9hjv1ABCgijP8QS/p6bNrDctJ9Juf9XEwxc2m8PIuGi9OoO/k2+qBXyV/zS0InqZ7eB0tTpJCIW4A5eTnmpOVyhC+lKXmVfAeswhS7FGPEDGpDh1G69UVSfNsy/Y+qp/+1VLq7D1UHh6I/9o6ofzz6E+9SFTKc0l0eaP27kLywHf6eqmf3mbZ/qIqkWdIsfeUbcXFr5Zr6sYpzXs8Q9P/+928mLKuurvV5qwAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":75,"unified_at_epoch_ms":1791190193688,"unified_at":"2026-10-05T08:49:53.688Z","metadata":{"hashes":{"sha256":"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485","sha1":"360f1ec8899f3a8cc13f9b78e8688ef77089f4fe","md5":"586d9e5d8a90301b494e833d36302383","sha512":"8b37094e7677ed91f7d5471d680f6d6e5f2273e61271bb2ec6a661aac3db7957841e0a11807926cba53aa2c4261e179dd3dabddaabdf9a7a1ff81e6973467043","ssdeep":"49152:j5pM0HdHHl43vRA9sX78IuPCUns2zkqhw/W8M3UNXFOrSnj940a7MZGz+T:g09He3pA9srju6UnsFd/WR3U5FOrSnj9","ssdeep_chunks":["49152:j5pM0Hd","49152:5pM0HdH","49152:pM0HdHH","49152:M0HdHHl","49152:0HdHHl4","49152:HdHHl43","49152:dHHl43v","49152:HHl43vR","49152:Hl43vRA","49152:l43vRA9","49152:43vRA9s","49152:3vRA9sX","49152:vRA9sX7","49152:RA9sX78","49152:A9sX78I","49152:9sX78Iu","49152:sX78IuP","49152:X78IuPC","49152:78IuPCU","49152:8IuPCUn","49152:IuPCUns","49152:uPCUns2","49152:PCUns2z","49152:CUns2zk","49152:Uns2zkq","49152:ns2zkqh","49152:s2zkqhw","49152:2zkqhw/","49152:zkqhw/W","49152:kqhw/W8","49152:qhw/W8M","49152:hw/W8M3","49152:w/W8M3U","49152:/W8M3UN","49152:W8M3UNX","49152:8M3UNXF","49152:M3UNXFO","49152:3UNXFOr","49152:UNXFOrS","49152:NXFOrSn","49152:XFOrSnj","49152:FOrSnj9","49152:OrSnj94","49152:rSnj940","49152:Snj940a","49152:nj940a7","49152:j940a7M","49152:940a7MZ","49152:40a7MZG","49152:0a7MZGz","49152:a7MZGz+","49152:7MZGz+T","98304:j5pM0Hd","98304:5pM0HdH","98304:pM0HdHH","98304:M0HdHHl","98304:0HdHHl4","98304:HdHHl43","98304:dHHl43v","98304:HHl43vR","98304:Hl43vRA","98304:l43vRA9","98304:43vRA9s","98304:3vRA9sX","98304:vRA9sX7","98304:RA9sX78","98304:A9sX78I","98304:9sX78Iu","98304:sX78IuP","98304:X78IuPC","98304:78IuPCU","98304:8IuPCUn","98304:IuPCUns","98304:uPCUns2","98304:PCUns2z","98304:CUns2zk","98304:Uns2zkq","98304:ns2zkqh","98304:s2zkqhw","98304:2zkqhw/","98304:zkqhw/W","98304:kqhw/W8","98304:qhw/W8M","98304:hw/W8M3","98304:w/W8M3U","98304:/W8M3UN","98304:W8M3UNX","98304:8M3UNXF","98304:M3UNXFO","98304:3UNXFOr","98304:UNXFOrS","98304:NXFOrSn","98304:XFOrSnj","98304:FOrSnj9","98304:OrSnj94","98304:rSnj940","98304:Snj940a","98304:nj940a7","98304:j940a7M","98304:940a7MZ","98304:40a7MZG","98304:0a7MZGz","98304:a7MZGz+","98304:7MZGz+T","49152:g09He3p","49152:09He3pA","49152:9He3pA9","49152:He3pA9s","49152:e3pA9sr","49152:3pA9srj","49152:pA9srju","49152:A9srju6","49152:9srju6U","49152:srju6Un","49152:rju6Uns","49152:ju6UnsF","49152:u6UnsFd","49152:6UnsFd/","49152:UnsFd/W","49152:nsFd/WR","49152:sFd/WR3","49152:Fd/WR3U","49152:d/WR3U5","49152:/WR3U5F","49152:WR3U5FO","49152:R3U5FOr","49152:3U5FOrS","49152:U5FOrSn","49152:5FOrSnj"],"imphash":"190a68e8b20f113549cc93e9b953504b"},"file_info":{"file_name":"360F1EC8899F3A8CC13F9B78E8688EF77089F4FE.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2714624,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1514243279000,"last_seen":1659122753000,"last_multi_scan":1659122753000}},"detections":{"summary":{"verdict":"malicious","score":75,"tags":null},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":14,"malicious_count":3,"total":26},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/FileCoder.uqvft","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.KeyPass.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.KeyPass.3 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.STOP.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.FileCrypter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00521c3e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.FileCoder.ewnjll","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/keylogg-DS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan Horse","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.6CDA16DF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.6CDA16DF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.6930","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.KeyPass.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EE9F2533600C091F246273960B5A2A1B7CEBA7697EDC5F23D4F6A980E7304485.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EE9F2533600C091F246273960B5A2A1B7CEBA7697EDC5F23D4F6A980E7304485.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Documents\\Visual Studio 2013\\Projects\\Encryption\\Release\\encrypt.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" with commandline \"--Admin\" (UID: 00015929-00003564)\n Spawned process \"\" with commandline \"--Service 3564\" (UID: 00016097-00003612)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.91274703761","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"PcaSvc\" service\n \"\" called \"OpenService\" to access the \"LanmanWorkstation\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe\", Handle: 424)\n \"\" is creating a new process (Name: \"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe\", Handle: 272)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 2147483648)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegOpenKeyExW\n RegEnumKeyExW\n RegEnumKeyW\n RegDeleteKeyW\n GetDriveTypeA\n GetFileAttributesW\n UnhandledExceptionFilter\n FindResourceExW\n OutputDebugStringA\n CopyFileW\n OutputDebugStringW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n CreateThread\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n LoadLibraryA\n GetFileSize\n OpenProcess\n DeleteFileA\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetComputerNameW\n WriteFile\n GetFileSizeEx\n FindNextFileW\n FindFirstFileW\n GetTempPathW\n CreateFileW\n CreateFileA\n Process32NextW\n LockResource\n GetCommandLineW\n Process32FirstW\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n CreateProcessA\n FindResourceW\n CreateProcessW\n Sleep\n VirtualAlloc\n ShellExecuteW\n ShellExecuteExW\n SetWindowsHookExW\n GetUpdateRect\n GetLastActivePopup\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"c4ca367580bb3675aa6e37759fbb367508bb367546ce367561383775de2f3775d0d9367500000000177975754f9175757f6f7575f4f7757511f77575f2837575857e757500000000\" to virtual address \"0x6CFC1000\" (part of module \"MSIMG32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe.bin\" (Offset: 1688460)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/68 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe\" (Handle: 424)\n \"\" wrote 52 bytes to a remote process \"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe\" (Handle: 424)\n \"\" wrote 4 bytes to a remote process \"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe\" (Handle: 424)\n \"\" wrote 32 bytes to a remote process \"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe\" (Handle: 272)\n \"\" wrote 52 bytes to a remote process \"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe\" (Handle: 272)\n \"\" wrote 4 bytes to a remote process \"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe\" (Handle: 272)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":57,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":20,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"5a4181ac7ca3e117a61a5fc3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":75,"malware_family":"malicious.1b8fb7","submit_name":"360F1EC8899F3A8CC13F9B78E8688EF77089F4FE.exe","analysis_start_time":"2017-12-25T23:54:36+00:00","indicators_count":{"informative":9,"suspicious":14,"malicious":3},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}],"processes":[{"pid":3416,"ppid":0,"name":"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe","command_line":"","sha256":"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485","normalized_path":"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe","uid":"00015687-00003416","icon":"$28"},{"pid":3564,"ppid":3416,"name":"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe","command_line":"--Admin","sha256":"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485","normalized_path":"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe","parent_uid":"00015687-00003416","uid":"00015929-00003564"},{"pid":3612,"ppid":3564,"name":"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe","command_line":"--Service 3564","sha256":"ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485","normalized_path":"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe","parent_uid":"00015929-00003564","uid":"00016097-00003612"}],"all_imported_dlls":["lpk.dll","sechost.dll","uxtheme.dll","msasn1.dll","wkscli.dll","ntdll.dll","propsys.dll","wininet.dll","sfc.dll","winsta.dll","davclnt.dll","oleaccrc.dll","devobj.dll","imm32.dll","msvcrt.dll","ole32.dll","clbcatq.dll","rpcss.dll","advapi32.dll","GdiPlus.dll","shlwapi.dll","msctf.dll","ntmarta.dll","drprov.dll","comctl32.dll","winmm.dll","mpr.dll","setupapi.dll","cryptbase.dll","gdi32.dll","profapi.dll","cscapi.dll","user32.dll","crypt32.dll","sspicli.dll","devrtl.dll","KernelBase.dll","shell32.dll","browcli.dll","oleaut32.dll","urlmon.dll","iertutil.dll","imageres.dll","davhlpr.dll","msimg32.dll","oleacc.dll","Wldap32.dll","dwmapi.dll","ntlanman.dll","apphelp.dll","sfc_os.dll","netutils.dll","kernel32.dll","usp10.dll","rpcrt4.dll","oledlg.dll","cfgmgr32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"C:\\ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485.exe","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\12322.txtt","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\123.txtt","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\12344.txtt","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\mpr.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"path":"\\%OSUSER%-PC\\IPC$","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4181ac7ca3e117a61a5fc3"}]}]}},"report_ids":{"sandbox_job_ids":["5a4181ac7ca3e117a61a5fc3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.KeyPass.Generic Sample ee9f2533600c… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ee9f2533600c…. Malware family: Ransom.KeyPass.Generic. Threat score 75/100. 15/29 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.KeyPass.Generic Sample ee9f2533600c… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ee9f2533600c…. Malware family: Ransom.KeyPass.Generic. Threat score 75/100. 15/29 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ee9f2533600c091f246273960b5a2a1b7ceba7697edc5f23d4f6a980e7304485"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.KeyPass.Generic Sample ee9f2533600c… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ee9f2533600c…. Malware family: Ransom.KeyPass.Generic. Threat score 75/100. 15/29 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]