Following a targeted ransomware campaign against a hospital network in Dallas, forensic investigators secure the...

The best answer is C because one of the most valuable direct outcomes of malware analysis is the identification of indicators of compromise that can be used to detect, contain, and scope the incident across the wider environment. CHFI v11 includes malware artifacts and indicators, static and dynamic malware analysis, and system and network behavior analysis. In a ransomware investigation, analysts want actionable outputs such as file hashes, mutex names, domains, IP addresses, registry artifacts, dropped files, persistence locations, and process behaviors. Those indicators allow defenders and forensic teams to search other systems, determine spread, and verify whether additional hosts were affected. Option D sounds plausible, but malicious intent is often already obvious in a ransomware case and is less operationally useful than concrete indicators. Option A may emerge in some investigations, but it is not always a direct or primary result of analyzing the sample itself. Option B goes beyond technical malware analysis into attribution, which usually requires broader investigative evidence. For CHFI exam purposes, the most direct and practical outcome of malware analysis is the production of indicators of compromise.