24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom Sample f29a0a45628b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f29a0a45628b…. Malware family: Trojan.Ransom. Threat score 100/100. 19/26 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f29a0a45628b018fd1135eeb7690f49c535a865b891b19deaeebf782d75c9532","keywords":["Malicious","Trojan.Ransom","malware analysis","sandbox report","threat intelligence","f29a0a45628b018fd1135eeb7690f49c535a865b891b19deaeebf782d75c9532"],"about":{"@type":"SoftwareApplication","name":"DecryptFiles2.exe.bin","applicationCategory":["peexe","executable"],"identifier":"f29a0a45628b018fd1135eeb7690f49c535a865b891b19deaeebf782d75c9532","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom","antivirusDetections":{"malicious":19,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T950,"" opened "C:\autoexec.bat" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\ose.exe" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\setup.exe" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml" with delete access26:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f29a0a45628b018fd1135eeb7690f49c535a865b891b19deaeebf782d75c9532","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791476213923,"unified_at":"2026-10-08T16:16:53.923Z","metadata":{"hashes":{"sha256":"f29a0a45628b018fd1135eeb7690f49c535a865b891b19deaeebf782d75c9532","sha1":"976cac71ddf6fc6b0575ed1430c1aea901ef041f","md5":"0f41b4ffb8935d540121962549a6db10","sha512":"d6b232b6f9f561fde7aaf6c071700997f0a2dec11aca69217d0854e954a38a83680e6b94b52d5bdecd402a88bb3c69f46150a838d8f4fde36f25be7977176fb2","ssdeep":"192:Mzdrr1FG1WDCgmjPZH1gt4kt9sNGXqQaMUA:Mprr1gkDCgSVzA9eGXqNMB","ssdeep_chunks":["192:Mzdrr1F","192:zdrr1FG","192:drr1FG1","192:rr1FG1W","192:r1FG1WD","192:1FG1WDC","192:FG1WDCg","192:G1WDCgm","192:1WDCgmj","192:WDCgmjP","192:DCgmjPZ","192:CgmjPZH","192:gmjPZH1","192:mjPZH1g","192:jPZH1gt","192:PZH1gt4","192:ZH1gt4k","192:H1gt4kt","192:1gt4kt9","192:gt4kt9s","192:t4kt9sN","192:4kt9sNG","192:kt9sNGX","192:t9sNGXq","192:9sNGXqQ","192:sNGXqQa","192:NGXqQaM","192:GXqQaMU","192:XqQaMUA","384:Mzdrr1F","384:zdrr1FG","384:drr1FG1","384:rr1FG1W","384:r1FG1WD","384:1FG1WDC","384:FG1WDCg","384:G1WDCgm","384:1WDCgmj","384:WDCgmjP","384:DCgmjPZ","384:CgmjPZH","384:gmjPZH1","384:mjPZH1g","384:jPZH1gt","384:PZH1gt4","384:ZH1gt4k","384:H1gt4kt","384:1gt4kt9","384:gt4kt9s","384:t4kt9sN","384:4kt9sNG","384:kt9sNGX","384:t9sNGXq","384:9sNGXqQ","384:sNGXqQa","384:NGXqQaM","384:GXqQaMU","384:XqQaMUA","192:Mprr1gk","192:prr1gkD","192:rr1gkDC","192:r1gkDCg","192:1gkDCgS","192:gkDCgSV","192:kDCgSVz","192:DCgSVzA","192:CgSVzA9","192:gSVzA9e","192:SVzA9eG","192:VzA9eGX","192:zA9eGXq","192:A9eGXqN","192:9eGXqNM","192:eGXqNMB"],"imphash":"a3581bfe28e762682dbc13d06bf2fda0"},"file_info":{"file_name":"DecryptFiles2.exe.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":8192,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287895000,"last_seen":1623386699000,"last_multi_scan":1623386699000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware","upx"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":7,"suspicious_count":12,"malicious_count":7,"total":26},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Xorist.lxle","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Xorist","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.AIG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_80% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Filecoder.Y.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.Q trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Ransom/Satan.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Xorist","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Xorist.ln","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nano":{"name":"Nano","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Suspicious-Confidence_85","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom_.049325BC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom_.049325BC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokada","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00018360-00002076-42617-113-004021D1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"*.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\6RgG4sD94Q3n4Q1.exe\"\n \"\" created file \"%TEMP%\\6RgG4sD94Q3n4Q1.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"HOW TO DECRYPT FILES.txt\" has type \"ASCII text with CRLF line terminators\"\n \"usbview.exe\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"readme.txt\" has type \"data\"\n \"Readme.txt\" has type \"data\"\n \"BBhrpau[1].jpg\" has type \"JPEG image data JFIF standard 1.01\"\n \"YAHOO.COM.VN.XML\" has type \"XML document text\"\n \"UI_bulletlist.gif\" has type \"GIF image data version 89a 23 x 22\"\n \"BD14795_.GIF\" has type \"GIF image data version 89a 12 x 12\"\n \"BD21295_.GIF\" has type \"GIF image data version 89a 15 x 13\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\explorer.exe\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.coinbase.com\"\n Pattern match: \"www.localbitcoins.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"DecryptFiles2.exe.bin.exe.bin\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.67413248393","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"DecryptFiles2.exe.bin.exe.bin\" has a section named \"UPX0\"\n \"DecryptFiles2.exe.bin.exe.bin\" has a section named \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00018360-00002076-42617-35-0040124F\n rdtsc at 00018360-00002076-42617-34-004010FC","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"pspubws@ssl.bing[2].txt\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"pspubws@adtech[1].txt\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"pspubws@ebay[2].txt\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"pspubws@bing[2].txt\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"pspubws@a.twiago[1].txt\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00018360-00002076-42617-54-00401F87\n FreeResource@KERNEL32.DLL at 00018360-00002076-42617-34-004010FC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"usbview.exe\" has type \"MS-DOS executable MZ for MS-DOS\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ALCMETER\"; Value: \"%TEMP%\\6RgG4sD94Q3n4Q1.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"payment\" (Source: screen_2.png, Indicator: \"payment\")\n \"DECRYPT-ID-631701S8\" (Source: screen_2.png, Indicator: \"decrypt\")\n \"epaYment,We5en\" (Source: screen_2.png, Indicator: \"payment\")\n \"decypt\" (Source: screen_2.png, Indicator: \"decrypt\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$25","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n VirtualAlloc\n LoadLibraryA\n RegCloseKey\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%TEMP%\\6RgG4sD94Q3n4Q1.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"51/58 Antivirus vendors marked sample as malicious (87% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"51/58 Antivirus vendors marked sample as malicious (87% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"UPX\" classified file \"DecryptFiles2.exe.bin.exe.bin\" as \"upx\" based on indicators: \"UPX0,UPX1,UPX!\" (Author: Kevin Breen )","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"HOW TO DECRYPT FILES.txt\" which has been seen in the context of ransomware (Indicator: how to decrypt files)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\DecryptFiles2.exe.bin.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"DecryptFiles2.exe.bin.exe.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a known ransomware file"}],"sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"}],"sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":24,"dropped_files_count":0,"extracted_files_count":144,"files_written_count":82,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware","upx"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"58a67455aac2eda90357f7da","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom","submit_name":"DecryptFiles2.exe.bin","analysis_start_time":"2017-02-17T04:57:51+00:00","indicators_count":{"informative":7,"suspicious":14,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}],"processes":[{"pid":2076,"ppid":0,"name":"DecryptFiles2.exe.bin.exe","command_line":"","normalized_path":"C:\\DecryptFiles2.exe.bin.exe","uid":"00018360-00002076","icon":"$26"}],"all_imported_dlls":["comctl32.dll","user32.dll","msctf.dll","ole32.dll","profapi.dll","dwmapi.dll","rpcss.dll","clbcatq.dll","oleaut32.dll","shlwapi.dll","sechost.dll","lpk.dll","uxtheme.dll","kernel32.dll","gdi32.dll","imm32.dll","cryptbase.dll","usp10.dll","shell32.dll","ntdll.dll","KernelBase.dll","advapi32.dll","msvcrt.dll","rpcrt4.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ReadMe.htm","sha256":"42b1e7a7bf175aa4358bef0b866efb2f21e14f10463c4cc5006e5c5d9462e98c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"AdobeCollabSync.exe","sha256":"fb38f8b14e382aa186e896cc06c0b90ffb1e06e8968faa7ce14c885689ebe3f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"AdobeID.pdf","sha256":"84920c9cdc41b87664dd2ba0c18b0533679b7dc1321e7ca36594c04cdb8d7d2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"DefaultID.pdf","sha256":"109cae14533075975d20b4281ee629113ca7141a91e9ed4ac1ba3ebeff656baa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"license.html","sha256":"bed5a047321855f598b5ea22790070704e0439c85c00a72b5016e350ce7daf91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"create_form.gif","sha256":"9dc7ab25ab7452cd21408b0ccd813016e8ac5a8a918caa0886394d0869473472","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"forms_received.gif","sha256":"46a7e03796343807322e04deb4bc3ad3912510a5d7d6e9ccfbc42667ee97e4bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"forms_super.gif","sha256":"a8e467dce69032f18707cb78c2c61ec53ca58db1ba3003462f545ba1334c6d77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"info.gif","sha256":"87977afbc9df90146965917377db338beffda9d9e2c2d0638d8dadd8b750e7ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"pdf.gif","sha256":"959a98c44f9187a5807cffdf3ae31bc0637c79684684a2848ed10e5bd0efd0c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"review_same_reviewers.gif","sha256":"400119ee1ce3a5045085e312f8e73da7a313956dc646e1a0c72ca5b4d28518c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"server_lg.gif","sha256":"c26408b4724a78c47b1978d05cd0283b40221c31e7b3678d885174682d026ceb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"warning.gif","sha256":"1f708fcd4baa3cf7f881a32b97e74250d2c42726b0299209523b5b12fcc785f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"CROATIAN.TXT","sha256":"f148a13a2593bd77adb31bae73df0ade7051d82b9f7e2e5f3dc5ff8d765402ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"GREEK.TXT","sha256":"be90816fff13cca6298f3acadaad7a4d370c9236a2ee19d90c74af5aeb275d20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"CP1253.TXT","sha256":"75e318456aa5a7b9c292c691e016c49c21d97a3a961c029f0aec28554d2176be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Application Verifier.lnk","sha256":"36c3acefc57f6fa1c383ed3bd4d0a6302353aa4bf86e4781a65864267380ec81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Au3Check.exe","sha256":"d9790d5c8cf818bbe574bf033ae5a23e331b1f108dc970c03e68c0edf064ede2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Au3Info_x64.exe","sha256":"10067c03f80b9826b6f2e63151cd1b13a3bfb1dc71a8a1f63253c47519f6ec06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Aut2exe.exe","sha256":"4718f8954b29fe2739d6ec54c8c30fa66920e3712125f3487ae9f14268acc38f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"upx.exe","sha256":"963e29dc7dfabf2c10307c7c4bfaaf8a8326c22a6b40946262f5e6053e76e8c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"ose.exe","sha256":"9d9eb0cf9ecec411476a96e16a9f93fb012527efb11e2ba26dd602292d259b7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"ShellUI.MST","sha256":"6c66af8742d1dab6bf064f1e59f881556090cfbc22a3ea2c071b725040c81a96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"usbview.exe","sha256":"c233215f266753af33c07a0fca40ea6105df9567a50a876d17250748c5cf0c3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"sunmscapi.jar","sha256":"7e9e03ecdd1986f4cc86fbfeefe46b61ef81729f05100c5537e946edc3453909","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"install.bat","sha256":"50e062b87a477940691551d59139396ba4348f680695b2b1d241db412031c109","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Internet Backgammon.lnk","sha256":"e8399dd349525ca091f949b35e63116d16efc75f829760aca4dd3df7821bf26f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"SmartTagInstall.exe","sha256":"7e45b2acac605c7c75be0af55e2eb0621d2073c12603c42d46e0b0a25cc6d1ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"WORDICON.EXE","sha256":"268fde7594cb85587a330c462352a2e912daad6e0a7c1360f978d65725e3a544","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"pdbcopy.exe","sha256":"8e99b81ae9c58cfef1cea93982ea93bcbdbfc2cc7696d371d53ff1bcf70af306","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"MSOSYNC.EXE","sha256":"d60f36563fb1df366b5a2c3bf23dc89503c97fb76879dae099e5dbebd3b7c160","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"kill.exe","sha256":"e824ff204af80dd8d6875c3b3f07de810f7c0f531b42c129d8d380b24f06f373","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Wireshark.lnk","sha256":"8d050f94318a5601d426ebdbb3a37d972b3af78a0760eab7d54b34e101e1c98f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"TlbExp.exe","sha256":"407093ef995155f6e67352baafbc637b8477d68b7212ef52c620d7a58567a856","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Private Character Editor.lnk","sha256":"71ad7e6ab338c162548a5abfefbc53c5230ca8d2631cfb301ce980bdf3c17040","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"dumpbin.exe","sha256":"0dd7e01058c3f7cdf897bf9d297567652017953aeefc8c14fc11803272dd4a65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Desktop background.lnk","sha256":"3362711980615f39ebc6a4155f56003ca6a331ecbf0b409eefea16dd6f8454d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Sticky Notes.lnk","sha256":"d1d3f2b74cffb516541f82ac32698d4958a7e24d3340efc0c1ee7e6910dab636","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"RC.Exe","sha256":"f61e0292bd306f602ed85de5862858c630ee0609ccdf32a87073bd18358fe8cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Browse Extras.lnk","sha256":"52afa3c9171832f938c36e7c697ff678d7d8ed73e4a8bab80029996133b6e4ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"cordbg.exe","sha256":"d32f4bd09895b2b2f4d89d30beb65a5f03e8d45107c7a0f582cf24f025a43843","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Install.Bat","sha256":"df153d8ffbc7dc570a318b68e481f46b25d9727d2a6c942525ab6956a2562d74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"ssvagent.exe","sha256":"de72abe364fba32489782492abc2182917d630d5aabf7ebd238b737e72f95112","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"VirtualAutorunDisabler.exe","sha256":"4c312e0201979fa7ebf06bfce0ab0c3ea366eb86efc58111b85492a713307925","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Uninstall.exe","sha256":"8b59303731b412b5634db059e59fccfd826284b835021a399aece290300781f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Internet Explorer.lnk","sha256":"546dac5a27f43d462f4e0b6f2ee4eaa6bc585996fd4577e381de7aab80ef6422","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"SpOrder.Exe","sha256":"2860aaf55d510ccb0f025d380a7d0dce3fd3e4948842bf958d9bcc24e086f417","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"securitypack.jar","sha256":"8af61549440da62daad2af88de4da3ef109cc9c7406e09b6dcd2101367c6afb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"WsTrace.bat","sha256":"1919d773d5e1bab50ffae11dd5575327c9430d93e7a17a9f38d4a5f3d78fc1c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"ilasm.exe","sha256":"485a6462d232700d8a5df521a1d8bbd89a5135c6f7615b82314dc483b309e05c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"make-shell.exe","sha256":"868e759ea67bab4d3f1f07ea97058a6b2b66fcc1daab500c27516263e80da882","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Minesweeper.lnk","sha256":"c6e39272c22d0487c086c8ed74c43e268aa64169d7ada2bdb6063b990170b987","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"servertool.exe","sha256":"acd3fa7fcf6c3eda2e2633391c19f67fc9e62b954c722e17ce274ba64e812120","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"System Information.lnk","sha256":"c927aa8aaacdb56b7155209ede26640c69e75dd6b47baa0cdc59cd77166f22e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Help.lnk","sha256":"a77f0d65354a6f62644ad9e8b13f267d3a8b64adde4f207acfe3dbbf0beac377","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"jucheck.exe","sha256":"a31afcf8263fe1ffc18b81e7d027383925e871cc4e5caeddd336a2091c1f596e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"chkrzm.exe","sha256":"a99fbceb7ddab37f02d23b041999ae663cc4613a9d33573ccdc3a78e246315ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"editbin.exe","sha256":"f44124912509530c6d53c97df10b8d928d0d7fbf385e880cbbf5ca044823156b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"sunjce_provider.jar","sha256":"5133850b3af948ac4d3a3cf0b7e6da8fed907f926c88bd77ec1b458957ceed0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"makecert.exe","sha256":"0e289740a70a908d56c8c7f31425266db88e216c68f92febb5283ecbc1071432","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"sn.exe","sha256":"f36382b913354f7624d92b01bf09e6fdd75dacb1f79ada2437b5a5ab423117f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"ildasm.exe","sha256":"8676c5d419b1a23df59878541baca76bf60bb3c785741b31f1a5bbd7de21e26a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"AddInProcess.exe","sha256":"2ef1f4d1d04b30adefd69562120456e807be4fa28c0fad9a1527525ce9a92815","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"On-Screen Keyboard.lnk","sha256":"adfa62f3de5201c0e75520ef43a90fb85b0e1c2c8c944977b40fda65993ead5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Debugging Help.lnk","sha256":"1ac52723ed59e0cbd7947e7edbb26abbf2321d4efad31c4ebb72e645c2e846d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"lc.exe","sha256":"261dc2b06a7ce9fc027798e4a67eac6b29cd2b14add2ad98eb9af7516399531c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"PWRPNT12.PPTX","sha256":"f9c0b3c9bd32942db0aac5119133e18125d1e039390750710ea14f9a1b6275e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"NETFXRepair.exe","sha256":"cf02f176b59fafbb0723d6d0dcff31fdee5c43cb4d25433736184dd2411bc415","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"GRAPH.EXE","sha256":"daa01ffbb4511f35a545291bdfd1d4081ec7a0241c61b8d129d165aec0a789ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"ComSvcConfig.exe","sha256":"479bf80241b303fa376640eb9d18fff0819211d80837cce6b72fac55c2ba7c6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"gflags.exe","sha256":"8eaeaeda035e74982fd35e19cee388c74dc9131587562bd1d88cabf5877e4e83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Run Script.lnk","sha256":"cdb9315c291aa9c2c8fbb55cf7b0c73e64f7f97a877ec4421b5117b5cb1cd83d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"logviewer.exe","sha256":"85b9c1c132810489cf4d73dd6f8ba4db688b1759b81fc49e170ea7e78960cf8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Internet Spades.lnk","sha256":"b8a5fb93542aeb4738ab7839e55478192b3e27b6428424238293397ada278edb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"contosoroot.cer","sha256":"b856bbb65306a0ae1fc479b741e54fdc1ac43bf723045104ff53c81413a383de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"wsdcodegen.exe","sha256":"73f77a355828cc013940361724eb3790e44062fccb8be9e406342f673f62b39f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"pgocvt.exe","sha256":"409372f357926160a2e936e308a091e520495d7e58b166a24e05a9cd1b28d746","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"plugin-container.exe","sha256":"e5ccc5cac70a4c67cc2d36320c489ede640e607c616081b33f6477a390ec4862","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Install Windows Performance Tool Kit.lnk","sha256":"c650a0c8e35d87c4389e5dbeab9b971fa934b77193e26b021e176ab32a3133f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"aspnet_merge.exe","sha256":"45c01a1406c3a5775bedbaa9f0c5f69c13620c09d4ff84de4494fefd330a2e29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"vswriter.exe","sha256":"feb1adc1b694b9fc954b5e58e90bc409275410a64cb78079cc41b061fa433700","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Windows Explorer.lnk","sha256":"7c26c62115306b46b49f68819a6982da5bc650a0f64264a4e86860adfebe7648","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Microsoft.Workflow.Compiler.ni.exe","sha256":"de3118e5c34e2f7991ad2e75e795a91198263162e8060ee5f8cdf849e7ccecdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"dfsvc.ni.exe","sha256":"12b4d3297954a2482c0f3cb956ff85b9417d0b04d811e4ee548d371a1ffb47fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Default Programs.lnk","sha256":"947aad1d7ebf8fb332f33f2f4540dc1283bddc6fdd0d1e7013f991fb6d9f88fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"PROTTPLV.XLS","sha256":"adfb5e556e0199219ff892146b74824d4a4dec27e58c1d01079e759ff5ba1571","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Windows DVD Maker.lnk","sha256":"71808e4fee0c965ccd5d1ca80f99cd30e38e75ed9ad4db065e39fec447f2d96b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"MsiMerg.Exe","sha256":"ec857a75440149df9067ff7b3d2de17cd31311ba4420de97ce397419c6e78761","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"SvcTraceViewer.exe","sha256":"908fcc6d52c20d77997c5f0f1493936f3f8372cc09a85ee323bbdfcebdbd3761","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"vssdump.exe","sha256":"1e40ceb2c045f5ef812f54eba75e84c9690a4d6e0e4ce9822e164efeb313b8e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"ONELEV.EXE","sha256":"8e66363556c4004722efece573869ff0ba88a9066d57a2c0a7295ffb90a60445","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"install.exe","sha256":"be71b3fd7b55964d99ed48e98b02c60a74a4c51ff99303fc0d5087f3c91334e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Samples Reference.lnk","sha256":"37681c0d47c2c9d5107fea0f153480dbd036749c91114f050a03149c9f0de90a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"ptconform.exe","sha256":"d06d75a38daf9a669ccc60c71f0ee0c181ad8f2bab130d198b78f1d705b5f29b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Mobility Center.lnk","sha256":"4514727645b7f02cd3680e6adb3f8db555a43cdbfb5547ba635300d3e05977d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"WsatConfig.ni.exe","sha256":"ebf6ddb35a18db09c26f826a596d17650e73b94c24759484f43d8827102f2b04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"pinned.lnk","sha256":"21c43d50e27994266d787030dabd631d4e24823d1a5e1fab9784281a9b0d6304","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Paint.lnk","sha256":"8f7ad8e43cf39374c8a50b90c9a4f52f235f7d248b6a3d9f9c9a042c21109a1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Hearts.lnk","sha256":"7f20a84c02b8e526904381e893604e87f77a6a648a429ab20753bca88b08fb6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Manifest_Generator.lnk","sha256":"e3fa32df69e75b964192600b3476b9d350345d062711c4c0656b8a71599a5427","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Uninstall.lnk","sha256":"b6f3cce9033196f936e885f900f6114e9253e2e2be7f0535f06cce605562ca87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Media Center.lnk","sha256":"ae8e44e26fd325cc3a7839659c2507590fa2f12723608d4b89fe7ceb12420390","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"java.exe","sha256":"c358cfc1a576cb49ed088ae1191c59462bccc06c9a29aee5468cb9c2b413a49c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"apatch.exe","sha256":"bb4cf30f1c7371868038e04de558f0b2f192cf31eb6ae878551dab1df2f62908","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"dumpexam.exe","sha256":"1a962cc858c7e854899a11cc33847b3ff6957ccd347e30bed53b2f2cee901ae5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"kd.exe","sha256":"4d88d7114ef49cc8cb50fd0116e31a1106310b63d38a1377560da8dcfde7265c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"MSTORDB.EXE","sha256":"302323b5f0ebb92accd4b973c2f9b41294abae3524e60c2bf3aef9b48a6d0fe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Au3Record.exe","sha256":"78816227dfb2bdff30da1d1288b454bfe626f63e839a553bd89d54507e539c76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Visual Studio 2008 x64 Cross Tools Command Prompt.lnk","sha256":"6fd5e06e4e114a3b7fca6679285db8ac30686ec2c8f7e2c281e37b7d28b919cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Adobe Reader XI.lnk","sha256":"dcb17569dea98bf8da3249363484076c2375ba880b057d26a8015d0a037b2198","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"RecentPlaces.lnk","sha256":"c948a13299d3fd2e6b0657b2f3cc6dd68106688c328112ede749f5419d1697a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Global Flags.lnk","sha256":"a6adfa19edcfcff5b47c2295bfee97bb378afdd8c8aa1781238e02f6ec9ff69b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"UISpy.exe","sha256":"8c7bc1351357fb7e8d0e71e2050ff5d0228b8c6290c45dda41589c65f60db85b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"pvk2pfx.exe","sha256":"0929d3b48df4cc4dc1a5fbda09b1ccab3e9e0f4ae8f2912f4b0120a2140fe667","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"MsiMsp.Exe","sha256":"347191098f54bd165e79d9b1fb8f2769e2633714e1f9e01d77dfbe1113ff10d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"rmid.exe","sha256":"241f3ea0dc697df06b39ae1e213c05c488d0770db3a079516f70801748a9a139","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"FileTypeVerifier.exe","sha256":"3978e37ba741fb425b7390d1cbbe2493dc303d62aab94f9c6fbf8d72d2987783","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"services.lnk","sha256":"67c73e6c617afbc3db9b8aadcadb2902d024231fa64e6deae2469bb05d0209b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"CorFlags.exe","sha256":"0c216fa9bc3979254080ecbff6ebe9a9682ac3de748b9649a5c2d82d9ee3b879","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Website.lnk","sha256":"972e1a6fa68533ab7bff319174ed49f92e98d3f0458e804d593d052ceae3f9fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Manifest Generation and Editing Tool.lnk","sha256":"7762b567fa3986a419dbea52cc0847de37754e3ff77cb8fa6e5ed5727ea817e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"GameExplorer.lnk","sha256":"b8a2db2ef90558d884b2963ab7c3ba60d87b9006cd782e5c51c52f1c618d7893","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"SMSvcHost.exe","sha256":"3e943e64803f8b14e0de1ffdcd11e3bc9c9facbd201515496f661cebfe53bdb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"uninstall.exe","sha256":"beef50d7fc895cd883684d9c497b2014f91cc7b03e89f24fa1fbe7ae83262034","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Control Panel.lnk","sha256":"f16a7c07a3c1475b3c9ba0f7d71a3ce1767fcdc8915f654c4f16f90e8ba3ff63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"IEContentService.exe","sha256":"eadad8a9564f9ebb7d33b96c445d3dfd2f57e5587f9c1ca9e5a4d28ce06a3c13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"mt.exe","sha256":"c713931136f5adaf4e3aeeed7fda3e96d2789822422e803a6ff1e045fc4a85d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"rmiregistry.exe","sha256":"cb16c375e908ebd4affc2074f77969a638096f729f11b22a9d3fd4d45a565315","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"aspnet_compiler.exe","sha256":"90f7f1dff46063ff938e23da222c2d3766ee5bae95c525de37b6a8c4fd0f19bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"vsstrace.exe","sha256":"6d122bd559de5a41ac0c4be8605ae34a0ecd5dafd0b5078d403d3b21a97559c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"plugin.jar","sha256":"90e99d87f0b13fb6ef84a33985d6142d1bd4be404b4394b4b8933ef058ed5989","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"MUIRCT.EXE","sha256":"eb57c77975f029cabf7aab24a19298ebc00e733090c35eb7fadab9eefd458373","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"themes.doc","sha256":"dbcc71d9f46ba67d3e48a69ee9c0416e35b83cc8b675b72cd030451859cd2ab4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"jjs.exe","sha256":"3847c5a15154f7fd7089f149f69b5c432574789cc3e00e3e424117b10bfff384","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Computer Management.lnk","sha256":"821bbd42542287b8204e00498ccfd78e1f3917681cdb5885821f314bde031c88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"uninstall64.exe","sha256":"28934109a3b9db4b4c8705ef09794ebd71be0d00bf21124c12f1c4dcfad3a212","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"More Games from Microsoft.lnk","sha256":"1539f7848095ba877ec05fe1da6bb7ca6b44788d08a4e15acf5f68df6fb89fa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"jce.jar","sha256":"bc9ead1d61f7f0805667811c64f400a2263e1d710dc31f301a1efb20006fb3cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Mdbg.exe","sha256":"b9eac394a1597447fb2a57edcb2ec6f18f2872b4114e0ef4f9f412608b5cfabb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"PROTTPLV.PPT","sha256":"7dfce5422bf7c546ee45038b25691cc5d15123af115cdf67ce139eff801a672a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"sunec.jar","sha256":"0576b4a6b7d6e8748970e22656df106497754570c69170e7806a664fee351367","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"FiltReg.exe","sha256":"839f4aea4d326da9e9b825345939759c5181e224d154109bc8c3b6f94a17dbe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"gc.exe","sha256":"5d28784e698b0ece5b21c307ed1f79282e9f49ff44a39c8ddbd02804cd5f1592","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"name":"Windows Resource Localization Editor.lnk","sha256":"e1d46cab4954a7c1275098e72d35138b4b3fde5e5696d93ff133d5bfeedce432","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]}],"files_written":[{"path":"%WINDIR%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\DecryptFiles2.exe.bin.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%TEMP%\\6RgG4sD94Q3n4Q1.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%TEMP%\\6RgG4sD94Q3n4Q1.exe","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\32Bit\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\32Bit\\Readme.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\64Bit\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\64Bit\\Readme.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\OS2\\VBoxReplaceDll.exe","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\OS2\\readme.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\OS2\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\VBoxWindowsAdditions-amd64.exe","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\VBoxWindowsAdditions-x86.exe","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\VBoxWindowsAdditions.exe","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\cert\\VBoxCertUtil.exe","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\cert\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\cert\\oracle-vbox.cer","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"D:\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\DecryptFiles2.exe.bin.exe","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Esl\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\prc\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\SaslPrep\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\ICU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\Application Verifier\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\AutoItX\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Images\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\.RSA-4096\\","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\AJPLGXIVVQORBDA\\","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\AJPLGXIVVQORBDA\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\AJPLGXIVVQORBDA\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\AJPLGXIVVQORBDA\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\AJPLGXIVVQORBDA\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"58a67455aac2eda90357f7da"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["58a67455aac2eda90357f7da"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Ransom Sample f29a0a45628b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f29a0a45628b…. Malware family: Trojan.Ransom. Threat score 100/100. 19/26 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f29a0a45628b018fd1135eeb7690f49c535a865b891b19deaeebf782d75c9532"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom Sample f29a0a45628b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f29a0a45628b…. Malware family: Trojan.Ransom. Threat score 100/100. 19/26 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f29a0a45628b018fd1135eeb7690f49c535a865b891b19deaeebf782d75c9532"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom Sample f29a0a45628b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f29a0a45628b…. Malware family: Trojan.Ransom. Threat score 100/100. 19/26 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]