5a612b52...9af3

Detection Information

Local AV Applied On	Sample Files, PCAP File, Downloaded Files, Dropped Files, Modified Files, Memory Dumps, Embedded Files
YARA Applied On	Sample Files, PCAP File, Downloaded Files, Dropped Files, Modified Files, Memory Dumps, Embedded Files

Local AV Matches (1)

File Type	Threat Name	Filename	Severity	Actions
Sample File	Gen:Variant.Ulise.37281	C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\rruzcj.exe	Malicious	... Local AV Actions Show File

YARA Matches (111)

Ruleset Name	Rule Name	Rule Description	File Type	Filename	Classification	Severity	Actions
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Boot\BOOTSTAT.DAT.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\BOOTSECT.BAK.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\setup.chm.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\branding.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\OfficeMUI.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\pss10r.chm.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\PrjProrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ProPlusrWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\VisiorWW.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.EPS.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.WW\Office32WW.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\PrjProrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PRJPROR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\ProjectMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.msi.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proof.fr\Proof.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Project.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUSR\ProPlusrWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\VisiorWW.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\VISIOR\SETUP.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\BASMLA.XSL.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Visio.en-us\VisioMUI.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.XML.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File
Ransomware	DharmaEncryptedFile	File encrypted by Dharma Ransomware	Dropped File	C:\Program Files\Common Files\Microsoft Shared\Smart Tag\METCONV.TXT.id-9C354B42.[restdoc@protonmail.com].zoh	Ransomware	Malicious	... YARA Actions Show Ruleset Show File

Remarks (1/1)

Detection Information

Before

After