23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom_CRYPDNC.A Sample 1ee580d60a43… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1ee580d60a43…. Malware family: Ransom_CRYPDNC.A. Threat score 100/100. 16/27 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1ee580d60a43a847140136874f2b8646a2de700457114c4df0e16170029cdb43","keywords":["Malicious","Ransom_CRYPDNC.A","malware analysis","sandbox report","threat intelligence","1ee580d60a43a847140136874f2b8646a2de700457114c4df0e16170029cdb43"],"about":{"@type":"SoftwareApplication","name":"DoNotChange ransomware","applicationCategory":["peexe","executable"],"identifier":"1ee580d60a43a847140136874f2b8646a2de700457114c4df0e16170029cdb43","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom_CRYPDNC.A","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T9c2,Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\System32\icacls.exe "c:\System Volume Information" /grant i9Uez8Y:F" (UID: 00019966-00002124) Spawned process "icacls.exe" with commandline ""c:\System Volume Information" /grant i9Uez8Y:F" (UID: 00019979-00002152) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\System32\icacls.exe "c:\System Volume Information" /remove i9Uez8Y" (UID: 00019988-00002116) Spawned process "icacls.exe" with commandline ""c:\System Volume Information" /remove i9Uez8Y" (UID: 00019998-00000908) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\System32\icacls.exe "d:\System Volume Information" /grant i9Uez8Y:F" (UID: 00020002-00000652) Spawned process "icacls.exe" with commandline ""d:\System Volume Information" /grant i9Uez8Y:F" (UID: 00020010-00000272) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\System32\icacls.exe "d:\System Volume Information" /remove i9Uez8Y" (UID: 00020014-00001968) Spawned process "icacls.exe" with commandline ""d:\System Volume Information" /remove i9Uez8Y" (UID: 00020023-00002120) Spawned process "net.exe" with commandline "net stop "MSSQLSERVER" /y" (UID: 00020027-00002208) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "MSSQLSERVER" /y" (UID: 00020033-00002140) Spawned process "net.exe" with commandline "net stop "MSSQL$SQL" /y" (UID: 00020041-00002084) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "MSSQL$SQL" /y" (UID: 00020047-00002220) Spawned process "net.exe" with commandline "net stop "MSSQL$SQLEXPRESS" /y" (UID: 00020060-00002256) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "MSSQL$SQLEXPRESS" /y" (UID: 00020067-00002260) Spawned process "net.exe" with commandline "net stop "postgresql-x64-9.6" /y" (UID: 00020074-00002300) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "postgresql-x64-9.6" /y" (UID: 00020081-00002160) Spawned process "net.exe" with commandline "net stop "Schedule" /y" (UID: 00020088-00002080) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "Schedule" /y" (UID: 00020094-00002240) Spawned process "net.exe" with commandline "net stop "RKeeperMidServer" /y" (UID: 00020101-00002304) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "RKeeperMidServer" /y" (UID: 00020108-00002360)25:T624,"C:\DoNotChange ransomware.exe" marked "%TEMP%\AdobeARM.log" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\AdobeSFX.log" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\Adobe_ADMLogs\Adobe_ADM.log" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\Adobe_ADMLogs\Adobe_GDE.log" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\ASPNETSetup_00000.log" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\au-descriptor-1.8.0_31-b13.xml" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\au-descriptor-1.8.0_45-b15.xml" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\bch1119.tmp" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\bch4EA.tmp" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\bch5EC3.tmp" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\BITBDF9.tmp" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\BITE961.tmp" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\chromesetup.msi" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\chrome_installer.log" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\dat019q.tmp" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\dat034Y.tmp" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\dat0PUR.tmp" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\dat1DWM.tmp" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\dat1GdU.tmp" for deletion "C:\DoNotChange ransomware.exe" marked "%TEMP%\dat1lpH.tmp" for deletion26:T570,"" opened "%TEMP%\AdobeARM.log" with delete access "" opened "%TEMP%\AdobeSFX.log" with delete access "" opened "%TEMP%\Adobe_ADMLogs\Adobe_ADM.log" with delete access "" opened "%TEMP%\Adobe_ADMLogs\Adobe_GDE.log" with delete access "" opened "%TEMP%\ASPNETSetup_00000.log" with delete access "" opened "%TEMP%\au-descriptor-1.8.0_31-b13.xml" with delete access "" opened "%TEMP%\au-descriptor-1.8.0_45-b15.xml" with delete access "" opened "%TEMP%\bch1119.tmp" with delete access "" opened "%TEMP%\bch4EA.tmp" with delete access "" opened "%TEMP%\bch5EC3.tmp" with delete access "" opened "%TEMP%\BITBDF9.tmp" with delete access "" opened "%TEMP%\BITE961.tmp" with delete access "" opened "%TEMP%\chromesetup.msi" with delete access "" opened "%TEMP%\chrome_installer.log" with delete access "" opened "%TEMP%\dat019q.tmp" with delete access "" opened "%TEMP%\dat034Y.tmp" with delete access "" opened "%TEMP%\dat0PUR.tmp" with delete access "" opened "%TEMP%\dat1DWM.tmp" with delete access "" opened "%TEMP%\dat1GdU.tmp" with delete access "" opened "%TEMP%\dat1lpH.tmp" with delete access27:T127a,Found dropped filename "QWfSLhRSIzwjS4.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "A.txt" which has been seen in the context of ransomware (Indicator: a.txt) Found dropped filename "ar6cEZyyC.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "MElB1FKqC2cxb6AE.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "SampleMusicBundle.zip.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "chrome.7z.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "gd7HlA2D90jF.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "upb6mTYvIr.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "TcN5yBXi.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "TNZzXxx4kY1R7f7p.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "J0j8.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "HOW TO DECODE FILES!!!.txt" which has been seen in the context of ransomware (Indicator: !!!.txt) Found dropped filename "caic.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "WFSamples.zip.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "XUPgjfK.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "OWOW64WW.cab.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "CrossTechnologySamples.zip.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "1q4yvQVxByym4.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "StdWW.cab.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "WCFSamples.zip.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "k9rCVCf.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "Wmih9mB0sDu.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "lM74.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "DZ1I0FX.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "BcZL4pkMX.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "0Og1.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "XjhA7gYLHhBHyEci.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "rbfKgDSibNA52.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "ffjcext.zip.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "ecazG0z.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "iwIAg.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "AL0XySsN7H7ugY.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "Cardspace_samples.zip.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "WPFSamples.zip.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "ieWzhDO3EIpCT.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "FrameworkSamples.zip.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "lg7Kv3Y5aqGhf94.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry) Found dropped filename "CjIBD.rar.id-7ES642406.cry" which has been seen in the context of ransomware (Indicator: .cry)28:T17d2,Spawned process "" (UID: 00018548-00003812) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\System32\icacls.exe "c:\System Volume Information" /grant i9Uez8Y:F" (UID: 00019966-00002124) Spawned process "icacls.exe" with commandline ""c:\System Volume Information" /grant i9Uez8Y:F" (UID: 00019979-00002152) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\System32\icacls.exe "c:\System Volume Information" /remove i9Uez8Y" (UID: 00019988-00002116) Spawned process "icacls.exe" with commandline ""c:\System Volume Information" /remove i9Uez8Y" (UID: 00019998-00000908) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\System32\icacls.exe "d:\System Volume Information" /grant i9Uez8Y:F" (UID: 00020002-00000652) Spawned process "icacls.exe" with commandline ""d:\System Volume Information" /grant i9Uez8Y:F" (UID: 00020010-00000272) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %WINDIR%\System32\icacls.exe "d:\System Volume Information" /remove i9Uez8Y" (UID: 00020014-00001968) Spawned process "icacls.exe" with commandline ""d:\System Volume Information" /remove i9Uez8Y" (UID: 00020023-00002120) Spawned process "net.exe" with commandline "net stop "MSSQLSERVER" /y" (UID: 00020027-00002208) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "MSSQLSERVER" /y" (UID: 00020033-00002140) Spawned process "net.exe" with commandline "net stop "MSSQL$SQL" /y" (UID: 00020041-00002084) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "MSSQL$SQL" /y" (UID: 00020047-00002220) Spawned process "net.exe" with commandline "net stop "MSSQL$SQLEXPRESS" /y" (UID: 00020060-00002256) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "MSSQL$SQLEXPRESS" /y" (UID: 00020067-00002260) Spawned process "net.exe" with commandline "net stop "postgresql-x64-9.6" /y" (UID: 00020074-00002300) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "postgresql-x64-9.6" /y" (UID: 00020081-00002160) Spawned process "net.exe" with commandline "net stop "Schedule" /y" (UID: 00020088-00002080) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "Schedule" /y" (UID: 00020094-00002240) Spawned process "net.exe" with commandline "net stop "RKeeperMidServer" /y" (UID: 00020101-00002304) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "RKeeperMidServer" /y" (UID: 00020108-00002360) Spawned process "net.exe" with commandline "net stop "RKeeperRepServer" /y" (UID: 00020115-00002320) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "RKeeperRepServer" /y" (UID: 00020122-00002372) Spawned process "net.exe" with commandline "net stop "SDBSERV" /y" (UID: 00020130-00002424) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "SDBSERV" /y" (UID: 00020141-00002460) Spawned process "net.exe" with commandline "net stop "SQLWriter" /y" (UID: 00020149-00002468) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "SQLWriter" /y" (UID: 00020156-00002512) Spawned process "net.exe" with commandline "net stop "TeamViewer" /y" (UID: 00020171-00002452) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "TeamViewer" /y" (UID: 00020184-00002488) Spawned process "net.exe" with commandline "net stop "hMailServer" /y" (UID: 00020197-00002568) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "hMailServer" /y" (UID: 00020204-00002596) Spawned process "net.exe" with commandline "net stop "MySQL" /y" (UID: 00020212-00002556) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "MySQL" /y" (UID: 00020218-00002660) Spawned process "net.exe" with commandline "net stop "MSSQL$S15292784" /y" (UID: 00020227-00002604) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "MSSQL$S15292784" /y" (UID: 00020236-00002656) Spawned process "net.exe" with commandline "net stop "SQLBrowser" /y" (UID: 00020244-00002704) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "SQLBrowser" /y" (UID: 00020251-00002676) Spawned process "net.exe" with commandline "net stop "FileZilla Server" /y" (UID: 00020259-00002744) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "FileZilla Server" /y" (UID: 00020267-00002788) Spawned process "net.exe" with commandline "net stop "RServer3" /y" (UID: 00020285-00002756) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "RServer3" /y" (UID: 00020293-00002820) Spawned process "net.exe" with commandline "net stop "afcdpsrv" /y" (UID: 00020302-00002804) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "afcdpsrv" /y" (UID: 00020308-00002868) Spawned process "net.exe" with commandline "net stop "syncagentsrv" /y" (UID: 00020316-00002864) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "syncagentsrv" /y" (UID: 00020323-00002888) Spawned process "net.exe" with commandline "net stop "C__UCS_CARDSERV_CARDSERV" /y" (UID: 00020333-00002848) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "C__UCS_CARDSERV_CARDSERV" /y" (UID: 00020340-00002908) Spawned process "net.exe" with commandline "net stop "Sdbserv 192.168.0.18" /y" (UID: 00020349-00002936) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "Sdbserv 192.168.0.18" /y" (UID: 00020356-00002912) Spawned process "net.exe" with commandline "net stop "tvnserver" /y" (UID: 00020365-00002968) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "tvnserver" /y" (UID: 00020377-00002928) Spawned process "net.exe" with commandline "net stop "SrvSgr030" /y" (UID: 00020420-00003028) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 stop "SrvSgr030" /y" (UID: 00020428-00003020) Spawned process "net.exe" with commandline "net stop "GbpSv" /y" (UID: 00020438-00003040)29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwB///////////////////cAf//////////////////3AH//////////////////9wB/+IiIiIiIj/iIiI////cAf/h3d3d3d4/////////3AH/4d3d3d3eP+IiIj///9wB/+Hd3d3d3j/////////cAf/h3d3d3d4/////////3AH/4d3d3d3eP+IiIj///9wB/+Hd3d3d3j/////////cAf/h3d3d3d4/4iIiP93/3AH/4d3d3d3eP//////d/9wB/+Hd3d3d3j/iIiI/3f/cAf/iHd3d3d4//////93/3AH/4d3d3d3eP+IiIj/d/9wB/+Hd3d3d3j//////2f/cAf/h3d3d3d4/4iIiP9m/3AH/4d3d3d3eP//////Zv9wB/+IiIiIiIj/iIiI/2b/cAf//////////////////3AH//////////////////9wB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==31:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==32:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==33:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==34:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==35:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==36:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==37:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"1ee580d60a43a847140136874f2b8646a2de700457114c4df0e16170029cdb43","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790439276750,"unified_at":"2026-09-26T16:14:36.750Z","metadata":{"hashes":{"sha256":"1ee580d60a43a847140136874f2b8646a2de700457114c4df0e16170029cdb43","sha1":"4815f8511cbf245ce23303c0da7e1a4bec7cd06d","md5":"1d1d7920ca66e454a9489000b25898a5","sha512":"08706016bb265949c28ce09a80f89fafb0306e89f8c6dd536169fbcbc63117b70a01e6c10cb3990e75fda5a9398e062e4606e0bbb2efa1393b8f25aabd12e7fa","ssdeep":"12288:hozGdX0M4ornOmZIzfMwHHQmRROXK+1O3c+jSX8U48zR41eWEPhlBAQyITTU3k:h4GHnhIzOaHjxUhRDWEPjBL7w3k","ssdeep_chunks":["12288:hozGdX0","12288:ozGdX0M","12288:zGdX0M4","12288:GdX0M4o","12288:dX0M4or","12288:X0M4orn","12288:0M4ornO","12288:M4ornOm","12288:4ornOmZ","12288:ornOmZI","12288:rnOmZIz","12288:nOmZIzf","12288:OmZIzfM","12288:mZIzfMw","12288:ZIzfMwH","12288:IzfMwHH","12288:zfMwHHQ","12288:fMwHHQm","12288:MwHHQmR","12288:wHHQmRR","12288:HHQmRRO","12288:HQmRROX","12288:QmRROXK","12288:mRROXK+","12288:RROXK+1","12288:ROXK+1O","12288:OXK+1O3","12288:XK+1O3c","12288:K+1O3c+","12288:+1O3c+j","12288:1O3c+jS","12288:O3c+jSX","12288:3c+jSX8","12288:c+jSX8U","12288:+jSX8U4","12288:jSX8U48","12288:SX8U48z","12288:X8U48zR","12288:8U48zR4","12288:U48zR41","12288:48zR41e","12288:8zR41eW","12288:zR41eWE","12288:R41eWEP","12288:41eWEPh","12288:1eWEPhl","12288:eWEPhlB","12288:WEPhlBA","12288:EPhlBAQ","12288:PhlBAQy","12288:hlBAQyI","12288:lBAQyIT","12288:BAQyITT","12288:AQyITTU","12288:QyITTU3","12288:yITTU3k","24576:hozGdX0","24576:ozGdX0M","24576:zGdX0M4","24576:GdX0M4o","24576:dX0M4or","24576:X0M4orn","24576:0M4ornO","24576:M4ornOm","24576:4ornOmZ","24576:ornOmZI","24576:rnOmZIz","24576:nOmZIzf","24576:OmZIzfM","24576:mZIzfMw","24576:ZIzfMwH","24576:IzfMwHH","24576:zfMwHHQ","24576:fMwHHQm","24576:MwHHQmR","24576:wHHQmRR","24576:HHQmRRO","24576:HQmRROX","24576:QmRROXK","24576:mRROXK+","24576:RROXK+1","24576:ROXK+1O","24576:OXK+1O3","24576:XK+1O3c","24576:K+1O3c+","24576:+1O3c+j","24576:1O3c+jS","24576:O3c+jSX","24576:3c+jSX8","24576:c+jSX8U","24576:+jSX8U4","24576:jSX8U48","24576:SX8U48z","24576:X8U48zR","24576:8U48zR4","24576:U48zR41","24576:48zR41e","24576:8zR41eW","24576:zR41eWE","24576:R41eWEP","24576:41eWEPh","24576:1eWEPhl","24576:eWEPhlB","24576:WEPhlBA","24576:EPhlBAQ","24576:PhlBAQy","24576:hlBAQyI","24576:lBAQyIT","24576:BAQyITT","24576:AQyITTU","24576:QyITTU3","24576:yITTU3k","12288:h4GHnhI","12288:4GHnhIz","12288:GHnhIzO","12288:HnhIzOa","12288:nhIzOaH","12288:hIzOaHj","12288:IzOaHjx","12288:zOaHjxU","12288:OaHjxUh","12288:aHjxUhR","12288:HjxUhRD","12288:jxUhRDW","12288:xUhRDWE","12288:UhRDWEP","12288:hRDWEPj","12288:RDWEPjB","12288:DWEPjBL","12288:WEPjBL7","12288:EPjBL7w","12288:PjBL7w3","12288:jBL7w3k"],"imphash":"7c9f129cf60b77e306dbe06e84a472f7"},"file_info":{"file_name":"DoNotChange ransomware","file_type":["peexe","executable"],"file_type_id":"exe","file_size":712704,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287366000,"last_seen":1690013881000,"last_multi_scan":1690013881000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["DoNotChange","Ransomware","upx"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":23,"malicious_count":9,"total":49},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1319455","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.BNZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.DoNotChange (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.Autoit.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.endnqw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_CRYPDNC.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_CRYPDNC.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptDNChang.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Autoit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.AutoIT.Win32.146551","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom_CRYPDNC.A","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00018548-00003812-32837-2196-0018A2D5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018548-00003812-32837-3437-0018A2A4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00018548-00003812-32837-2677-0018537A\n GetLocalTime@KERNEL32.DLL at 00018548-00003812-32837-2664-0016C707\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00018548-00003812-32837-3468-00195007\n GetLocalTime@KERNEL32.DLL at 00018548-00003812-32837-3883-001CDCA6\n GetLocalTime@KERNEL32.DLL at 00018548-00003812-32837-3069-001C56A4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00018548-00003812-32837-2258-001940BA","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00018548-00003812-32837-3254-00164AFE","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00018548-00003812-32837-3847-001CB487\n GetDiskFreeSpaceW@KERNEL32.DLL at 00018548-00003812-32837-3848-001CB54F\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00018548-00003812-32837-3846-001CB3BF","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.DLL (Target: \"DoNotChange ransomware.exe\"; Stream UID: \"00018548-00003812-32837-3069-001C56A4\")\n which is directly followed by \"cmp word ptr [esi], 0000h\" and \"je 001C581Ch\". See related instructions: \"...\n+0 push ebp\n+1 mov ebp, esp\n+3 sub esp, 0Ch\n+6 push esi\n+7 push edi\n+8 mov edi, edx\n+10 mov esi, ecx\n+12 push edi\n+13 call dword ptr [001EF258h] ;GetLocalTime\n+19 cmp word ptr [esi], 0000h\n+23 je 001C581Ch\" ... at 00018548-00003812-32837-3069-001C56A4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3524-001B8593\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3522-001B7FD7\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3161-00199922\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3528-001B83D1\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3527-001B81D4\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3529-001B8432\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3526-001B852A\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3525-001B85C7\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3523-001B8493\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3537-001B8B3B\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3541-001B8C54\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3536-001B8BE3\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-3532-001B897E\n GetProcessHeap@KERNEL32.DLL at 00018548-00003812-32837-4648-00188CFC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"RegisterHotKey@USER32.DLL at 00018548-00003812-32837-3345-00172817\n UnregisterHotKey@USER32.DLL at 00018548-00003812-32837-3277-0016FBBD","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"%WINDIR%\\system32\\cmd.exe /c %WINDIR%\\System32\\icacls.exe \"c:\\System Volume Information\" /grant i9Uez8Y:F\" on 2017-3-30.03:29:00.390\n \"%WINDIR%\\system32\\cmd.exe /c %WINDIR%\\System32\\icacls.exe \"c:\\System Volume Information\" /remove i9Uez8Y\" on 2017-3-30.03:29:00.610\n \"%WINDIR%\\system32\\cmd.exe /c %WINDIR%\\System32\\icacls.exe \"d:\\System Volume Information\" /grant i9Uez8Y:F\" on 2017-3-30.03:29:00.741\n \"%WINDIR%\\system32\\cmd.exe /c %WINDIR%\\System32\\icacls.exe \"d:\\System Volume Information\" /remove i9Uez8Y\" on 2017-3-30.03:29:00.871","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$24","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00018548-00003812-32837-2664-0016C707","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"QWfSLhRSIzwjS4.rar.id-7ES642406.cry\" has type \"data\"\n \"SampleMusicBundle.zip\" has type \"data\"\n \"A.txt\" has type \"UTF-8 Unicode text with CRLF line terminators\"\n \"MElB1FKqC2cxb6AE.rar\" has type \"data\"\n \"ar6cEZyyC.rar\" has type \"data\"\n \"ar6cEZyyC.rar.id-7ES642406.cry\" has type \"data\"\n \"DZ1I0FX.rar\" has type \"data\"\n \"MElB1FKqC2cxb6AE.rar.id-7ES642406.cry\" has type \"data\"\n \"SampleMusicBundle.zip.id-7ES642406.cry\" has type \"data\"\n \"OWOW64WW.cab\" has type \"data\"\n \"rbfKgDSibNA52.rar\" has type \"data\"\n \"chrome.7z.id-7ES642406.cry\" has type \"Dyalog APL\"\n \"gd7HlA2D90jF.rar.id-7ES642406.cry\" has type \"data\"\n \"upb6mTYvIr.rar.id-7ES642406.cry\" has type \"data\"\n \"BcZL4pkMX.rar\" has type \"data\"\n \"TcN5yBXi.rar.id-7ES642406.cry\" has type \"data\"\n \"TNZzXxx4kY1R7f7p.rar.id-7ES642406.cry\" has type \"data\"\n \"lM74.rar\" has type \"data\"\n \"J0j8.rar.id-7ES642406.cry\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"c;/.BJ\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"DoNotChange ransomware.exe.bin\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly tries to hide a process launching it with different user credentials","description":"CreateProcessWithLogonW@ADVAPI32.DLL at 00018548-00003812-32837-3540-001B88D9\n CreateProcessAsUserW@ADVAPI32.DLL at 00018548-00003812-32837-3535-001B8638","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.DLL at 00018548-00003812-32837-4078-001D401F","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1\n .rsrc with unusual entropies 7.93571733508\n 7.93236784475","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"DoNotChange ransomware.exe.bin\" has a section named \"UPX0\"\n \"DoNotChange ransomware.exe.bin\" has a section named \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00018548-00003812-32837-2664-0016C707\n cpuid at 00018548-00003812-32837-3427-001887AB","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"icacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to display shared resources","description":"Process \"net.exe\" with commandline \"net stop \"TeamViewer\" /y\" (UID: 00020171-00002452)","origin":"Monitored Target","relevance":10,"id":"target-41","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.DLL at 00018548-00003812-32837-2960-00164FE9\n FindResourceW@KERNEL32.DLL at 00018548-00003812-32837-3768-001C3F8E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"net1.exe\" called \"OpenSCManager\" requesting access rights \"0X80000000L\"\n \"net1.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"net1.exe\" called \"OpenService\" to access the \"MSSQLSERVER\" service\n \"net1.exe\" called \"OpenService\" to access the \"MSSQL$SQL\" service\n \"net1.exe\" called \"OpenService\" to access the \"MSSQL$SQLEXPRESS\" service\n \"net1.exe\" called \"OpenService\" to access the \"POSTGRESQL-X64-9.6\" service\n \"net1.exe\" called \"OpenService\" to access the \"SCHEDULE\" service\n \"net1.exe\" called \"OpenService\" to access the \"SCHEDULE\" service requesting \"SERVICE_STOP\" (0X20) access rights\n \"net1.exe\" called \"OpenService\" to access the \"RKEEPERMIDSERVER\" service\n \"net1.exe\" called \"OpenService\" to access the \"RKEEPERREPSERVER\" service\n \"net1.exe\" called \"OpenService\" to access the \"SDBSERV\" service\n \"net1.exe\" called \"OpenService\" to access the \"SQLWRITER\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"net1.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_INTERROGATE\" (0X4) to the service \"SCHEDULE\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00018548-00003812-32837-4147-001D6399","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"SDBSERV 192.168.0.18\"\n \"255.255.255.255\"\n \"5.255.255.255\"\n Heuristic match: \"net stop \"Sdbserv 192.168.0.18\" /y\"\n Heuristic match: \"%WINDIR%\\system32\\net1 stop \"Sdbserv 192.168.0.18\" /y\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"net stop \"uvnc_service\" /y\" (Indicator for product: Generic VNC)\n \"%WINDIR%\\system32\\net1 stop \"uvnc_service\" /y\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00018548-00003812-32837-2756-001C3C99\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00018548-00003812-32837-4203-001DEF21","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00018548-00003812-32837-4083-001D427A\n OpenClipboard@USER32.DLL at 00018548-00003812-32837-4080-001D407C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.DLL at 00018548-00003812-32837-3720-001C1097\n GetKeyboardState@USER32.DLL at 00018548-00003812-32837-3726-001C127E\n GetAsyncKeyState@USER32.DLL at 00018548-00003812-32837-3706-001C003A\n GetKeyboardState@USER32.DLL at 00018548-00003812-32837-3709-001C0F42\n GetKeyboardState@USER32.DLL at 00018548-00003812-32837-3708-001C034D\n GetKeyboardState@USER32.DLL at 00018548-00003812-32837-3724-001C0E07","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$25","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"IcmpSendEcho\n VirtualProtect\n GetProcAddress\n VirtualAlloc\n LoadLibraryA\n FtpOpenFileW\n connect (Ordinal #4)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"net.exe\" wrote bytes \"4053597758585a77186a5a77653c5b770000000000bfb8760000000056ccb876000000007ccab87600000000376873756a2c5b77d62d5b7700000000206973750000000029a6b87600000000a48d737500000000f70eb87600000000\" to virtual address \"0x76911000\" (part of module \"NSI.DLL\")\n \"net1.exe\" wrote bytes \"4053597758585a77186a5a77653c5b770000000000bfb8760000000056ccb876000000007ccab87600000000376873756a2c5b77d62d5b7700000000206973750000000029a6b87600000000a48d737500000000f70eb87600000000\" to virtual address \"0x76911000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"20/61 Antivirus vendors marked sample as malicious (32% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"20/61 Antivirus vendors marked sample as malicious (32% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00018548-00003812-32837-3828-001CA279\n DeviceIoControl@KERNEL32.DLL at 00018548-00003812-32837-3767-001C3EB6\n DeviceIoControl@KERNEL32.DLL at 00018548-00003812-32837-3766-001C3E26\n DeviceIoControl@KERNEL32.DLL at 00018548-00003812-32837-3765-001C3DA5","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"20/61 Antivirus vendors marked spawned process \"\" (PID: 3812) as malicious (classified as \"Trojan.Generic\" with 32% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"UPX\" classified file \"DoNotChange ransomware.exe.bin\" as \"upx\" based on indicators: \"UPX0,UPX1,UPX!\" (Author: Kevin Breen )","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"$27","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"icacls.exe\" with commandline \"\"c:\\System Volume Information\" /grant i9Uez8Y:F\" (UID: 00019979-00002152)\n Process \"icacls.exe\" with commandline \"\"c:\\System Volume Information\" /remove i9Uez8Y\" (UID: 00019998-00000908)\n Process \"icacls.exe\" with commandline \"\"d:\\System Volume Information\" /grant i9Uez8Y:F\" (UID: 00020010-00000272)\n Process \"icacls.exe\" with commandline \"\"d:\\System Volume Information\" /remove i9Uez8Y\" (UID: 00020023-00002120)","origin":"Monitored Target","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"DoNotChange ransomware.exe.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$28","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Contains ability to listen for incoming connections"},{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a known ransomware file"}],"sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Grants permissions using icacls (DACL modification)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Tries to display shared resources"}],"sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]}]},"activity":{"stats":{"process_count":69,"spawned_processes_count":69,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":56,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["DoNotChange","Ransomware","upx"],"sample_flags":["Extracted Files","User Comment"],"sandbox_reports":[{"id":"58dcd65baac2ed2e2f6ff64b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"DoNotChange ransomware","analysis_start_time":"2017-03-30T11:59:41+00:00","indicators_count":{"informative":17,"suspicious":33,"malicious":11},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}],"processes":[{"pid":3812,"ppid":0,"name":"DoNotChange ransomware.exe","command_line":"","sha256":"1ee580d60a43a847140136874f2b8646a2de700457114c4df0e16170029cdb43","normalized_path":"C:\\DoNotChange ransomware.exe","uid":"00018548-00003812","icon":"$29"},{"pid":2124,"ppid":3812,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c %WINDIR%\\System32\\icacls.exe \"c:\\System Volume Information\" /grant i9Uez8Y:F","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018548-00003812","uid":"00019966-00002124","icon":"$2a"},{"pid":2152,"ppid":2124,"name":"icacls.exe","command_line":"\"c:\\System Volume Information\" /grant i9Uez8Y:F","sha256":"e78b14513c47c1339d96065237e9d270f33d595d5a92f2b5c8f4f841e2a4ad5c","normalized_path":"%WINDIR%\\System32\\icacls.exe","parent_uid":"00019966-00002124","uid":"00019979-00002152","icon":"$2b"},{"pid":2116,"ppid":3812,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c %WINDIR%\\System32\\icacls.exe \"c:\\System Volume Information\" /remove i9Uez8Y","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018548-00003812","uid":"00019988-00002116","icon":"$2c"},{"pid":908,"ppid":2116,"name":"icacls.exe","command_line":"\"c:\\System Volume Information\" /remove i9Uez8Y","sha256":"e78b14513c47c1339d96065237e9d270f33d595d5a92f2b5c8f4f841e2a4ad5c","normalized_path":"%WINDIR%\\System32\\icacls.exe","parent_uid":"00019988-00002116","uid":"00019998-00000908","icon":"$2d"},{"pid":652,"ppid":3812,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c %WINDIR%\\System32\\icacls.exe \"d:\\System Volume Information\" /grant i9Uez8Y:F","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018548-00003812","uid":"00020002-00000652","icon":"$2e"},{"pid":272,"ppid":652,"name":"icacls.exe","command_line":"\"d:\\System Volume Information\" /grant i9Uez8Y:F","sha256":"e78b14513c47c1339d96065237e9d270f33d595d5a92f2b5c8f4f841e2a4ad5c","normalized_path":"%WINDIR%\\System32\\icacls.exe","parent_uid":"00020002-00000652","uid":"00020010-00000272","icon":"$2f"},{"pid":1968,"ppid":3812,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c %WINDIR%\\System32\\icacls.exe \"d:\\System Volume Information\" /remove i9Uez8Y","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018548-00003812","uid":"00020014-00001968","icon":"$30"},{"pid":2120,"ppid":1968,"name":"icacls.exe","command_line":"\"d:\\System Volume Information\" /remove i9Uez8Y","sha256":"e78b14513c47c1339d96065237e9d270f33d595d5a92f2b5c8f4f841e2a4ad5c","normalized_path":"%WINDIR%\\System32\\icacls.exe","parent_uid":"00020014-00001968","uid":"00020023-00002120","icon":"$31"},{"pid":2208,"ppid":3812,"name":"net.exe","command_line":"net stop \"MSSQLSERVER\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020027-00002208","icon":"$32"},{"pid":2140,"ppid":2208,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"MSSQLSERVER\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020027-00002208","uid":"00020033-00002140","icon":"$33"},{"pid":2084,"ppid":3812,"name":"net.exe","command_line":"net stop \"MSSQL$SQL\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020041-00002084","icon":"$34"},{"pid":2220,"ppid":2084,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"MSSQL$SQL\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020041-00002084","uid":"00020047-00002220","icon":"$35"},{"pid":2256,"ppid":3812,"name":"net.exe","command_line":"net stop \"MSSQL$SQLEXPRESS\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020060-00002256","icon":"$36"},{"pid":2260,"ppid":2256,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"MSSQL$SQLEXPRESS\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020060-00002256","uid":"00020067-00002260","icon":"$37"},{"pid":2300,"ppid":3812,"name":"net.exe","command_line":"net stop \"postgresql-x64-9.6\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020074-00002300"},{"pid":2160,"ppid":2300,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"postgresql-x64-9.6\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020074-00002300","uid":"00020081-00002160"},{"pid":2080,"ppid":3812,"name":"net.exe","command_line":"net stop \"Schedule\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020088-00002080"},{"pid":2240,"ppid":2080,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"Schedule\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020088-00002080","uid":"00020094-00002240"},{"pid":2304,"ppid":3812,"name":"net.exe","command_line":"net stop \"RKeeperMidServer\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020101-00002304"},{"pid":2360,"ppid":2304,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"RKeeperMidServer\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020101-00002304","uid":"00020108-00002360"},{"pid":2320,"ppid":3812,"name":"net.exe","command_line":"net stop \"RKeeperRepServer\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020115-00002320"},{"pid":2372,"ppid":2320,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"RKeeperRepServer\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020115-00002320","uid":"00020122-00002372"},{"pid":2424,"ppid":3812,"name":"net.exe","command_line":"net stop \"SDBSERV\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020130-00002424"},{"pid":2460,"ppid":2424,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"SDBSERV\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020130-00002424","uid":"00020141-00002460"},{"pid":2468,"ppid":3812,"name":"net.exe","command_line":"net stop \"SQLWriter\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020149-00002468"},{"pid":2512,"ppid":2468,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"SQLWriter\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020149-00002468","uid":"00020156-00002512"},{"pid":2452,"ppid":3812,"name":"net.exe","command_line":"net stop \"TeamViewer\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020171-00002452"},{"pid":2488,"ppid":2452,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"TeamViewer\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020171-00002452","uid":"00020184-00002488"},{"pid":2568,"ppid":3812,"name":"net.exe","command_line":"net stop \"hMailServer\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020197-00002568"},{"pid":2596,"ppid":2568,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"hMailServer\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020197-00002568","uid":"00020204-00002596"},{"pid":2556,"ppid":3812,"name":"net.exe","command_line":"net stop \"MySQL\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020212-00002556"},{"pid":2660,"ppid":2556,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"MySQL\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020212-00002556","uid":"00020218-00002660"},{"pid":2604,"ppid":3812,"name":"net.exe","command_line":"net stop \"MSSQL$S15292784\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020227-00002604"},{"pid":2656,"ppid":2604,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"MSSQL$S15292784\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020227-00002604","uid":"00020236-00002656"},{"pid":2704,"ppid":3812,"name":"net.exe","command_line":"net stop \"SQLBrowser\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020244-00002704"},{"pid":2676,"ppid":2704,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"SQLBrowser\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020244-00002704","uid":"00020251-00002676"},{"pid":2744,"ppid":3812,"name":"net.exe","command_line":"net stop \"FileZilla Server\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020259-00002744"},{"pid":2788,"ppid":2744,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"FileZilla Server\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020259-00002744","uid":"00020267-00002788"},{"pid":2756,"ppid":3812,"name":"net.exe","command_line":"net stop \"RServer3\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020285-00002756"},{"pid":2820,"ppid":2756,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"RServer3\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020285-00002756","uid":"00020293-00002820"},{"pid":2804,"ppid":3812,"name":"net.exe","command_line":"net stop \"afcdpsrv\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020302-00002804"},{"pid":2868,"ppid":2804,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"afcdpsrv\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020302-00002804","uid":"00020308-00002868"},{"pid":2864,"ppid":3812,"name":"net.exe","command_line":"net stop \"syncagentsrv\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020316-00002864"},{"pid":2888,"ppid":2864,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"syncagentsrv\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020316-00002864","uid":"00020323-00002888"},{"pid":2848,"ppid":3812,"name":"net.exe","command_line":"net stop \"C__UCS_CARDSERV_CARDSERV\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020333-00002848"},{"pid":2908,"ppid":2848,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"C__UCS_CARDSERV_CARDSERV\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020333-00002848","uid":"00020340-00002908"},{"pid":2936,"ppid":3812,"name":"net.exe","command_line":"net stop \"Sdbserv 192.168.0.18\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020349-00002936"},{"pid":2912,"ppid":2936,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"Sdbserv 192.168.0.18\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020349-00002936","uid":"00020356-00002912"},{"pid":2968,"ppid":3812,"name":"net.exe","command_line":"net stop \"tvnserver\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020365-00002968"},{"pid":2928,"ppid":2968,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"tvnserver\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020365-00002968","uid":"00020377-00002928"},{"pid":3028,"ppid":3812,"name":"net.exe","command_line":"net stop \"SrvSgr030\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020420-00003028"},{"pid":3020,"ppid":3028,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"SrvSgr030\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020420-00003028","uid":"00020428-00003020"},{"pid":3040,"ppid":3812,"name":"net.exe","command_line":"net stop \"GbpSv\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020438-00003040"},{"pid":3108,"ppid":3040,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"GbpSv\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020438-00003040","uid":"00020446-00003108"},{"pid":3072,"ppid":3812,"name":"net.exe","command_line":"net stop \"uvnc_service\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020455-00003072"},{"pid":2324,"ppid":3072,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"uvnc_service\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020455-00003072","uid":"00020464-00002324"},{"pid":2340,"ppid":3812,"name":"net.exe","command_line":"net stop \"MSSQL$MEGASUL\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020474-00002340"},{"pid":2412,"ppid":2340,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"MSSQL$MEGASUL\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020474-00002340","uid":"00020483-00002412"},{"pid":2500,"ppid":3812,"name":"net.exe","command_line":"net stop \"fbguard\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020492-00002500"},{"pid":2528,"ppid":2500,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"fbguard\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020492-00002500","uid":"00020500-00002528"},{"pid":2592,"ppid":3812,"name":"net.exe","command_line":"net stop \"fbserver\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020510-00002592"},{"pid":2664,"ppid":2592,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"fbserver\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020510-00002592","uid":"00020518-00002664"},{"pid":3176,"ppid":3812,"name":"net.exe","command_line":"net stop \"D_RK6CARDSERV_CARDSERV\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020540-00003176"},{"pid":3252,"ppid":3176,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"D_RK6CARDSERV_CARDSERV\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020540-00003176","uid":"00020553-00003252"},{"pid":3236,"ppid":3812,"name":"net.exe","command_line":"net stop \"acrSch2Svr\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020568-00003236"},{"pid":3348,"ppid":3236,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"acrSch2Svr\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020568-00003236","uid":"00020583-00003348"},{"pid":3352,"ppid":3812,"name":"net.exe","command_line":"net stop \"acrSch2Svr\" /y","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00018548-00003812","uid":"00020594-00003352"},{"pid":2016,"ppid":3352,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 stop \"acrSch2Svr\" /y","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020594-00003352","uid":"00020602-00002016"}],"all_imported_dlls":["userenv.dll","uxtheme.dll","cryptbase.dll","sspicli.dll","cryptsp.dll","wkscli.dll","msvcrt.dll","rpcrt4.dll","lpk.dll","nsi.dll","crypt32.dll","msctf.dll","tzres.dll","srvcli.dll","comdlg32.dll","profapi.dll","iertutil.dll","ws2_32.dll","dwmapi.dll","netapi32.dll","psapi.dll","version.dll","msasn1.dll","winbrand.dll","samcli.dll","dsrole.dll","logoncli.dll","samlib.dll","kernel32.dll","usp10.dll","wsock32.dll","ntdsapi.dll","advapi32.dll","sechost.dll","comctl32.dll","user32.dll","shlwapi.dll","shell32.dll","winnsi.dll","mpr.dll","urlmon.dll","winmm.dll","imm32.dll","rsaenh.dll","netutils.dll","netmsg.dll","KernelBase.dll","IPHLPAPI.DLL","ole32.dll","oleaut32.dll","wininet.dll","rpcss.dll","apphelp.dll","browcli.dll","ntdll.dll","gdi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SampleMusicBundle.zip.id-7ES642406.cry","sha256":"b0103add6ee749d09f6d69347b12de2e297dcee45467dde7def1dfcebcce77e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"J0j8.rar.id-7ES642406.cry","sha256":"8c29992f9ed42f1f6840b55b736adede857ff140a54dec524cae1ae7fc16c9fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"QWfSLhRSIzwjS4.rar.id-7ES642406.cry","sha256":"64c2bca17b46781a3e1a65dac11980f2d19398fbd86061cbecef7bf0690e8773","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"SampleMusicBundle.zip","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"A.txt","sha256":"b9060809f545ecb4d2b8c9693a54c63329ca72b3ae897bec2cbf3b4e938477c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"MElB1FKqC2cxb6AE.rar","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"ar6cEZyyC.rar","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"ar6cEZyyC.rar.id-7ES642406.cry","sha256":"b8bccc8f88a04846aa646dbc45861f5dc982f4f4c2bb834f6ebb9279fef87e15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"DZ1I0FX.rar","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"MElB1FKqC2cxb6AE.rar.id-7ES642406.cry","sha256":"ed7167572fe953d5a1e52848b10fcfc504e74763975d557ede21657d4801e93c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"OWOW64WW.cab","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"rbfKgDSibNA52.rar","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"chrome.7z.id-7ES642406.cry","sha256":"4fddf8f04fb6c21c4029b1deb935c458f2f04c8acfc5c3153cb1930f5ab37d0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"gd7HlA2D90jF.rar.id-7ES642406.cry","sha256":"7a10882a895d3f73c91629b52879635758ce7777fea0c930b5ac9ccafb954148","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"upb6mTYvIr.rar.id-7ES642406.cry","sha256":"b8bf01810239af47c53c6a5f214d7708cb95e907b9d5e9ad8f9a3c9297206212","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"BcZL4pkMX.rar","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"TcN5yBXi.rar.id-7ES642406.cry","sha256":"8c29992f9ed42f1f6840b55b736adede857ff140a54dec524cae1ae7fc16c9fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"TNZzXxx4kY1R7f7p.rar.id-7ES642406.cry","sha256":"8c29992f9ed42f1f6840b55b736adede857ff140a54dec524cae1ae7fc16c9fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"name":"lM74.rar","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]}],"files_written":[{"path":"C:\\DoNotChange ransomware.exe","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"path":"%WINDIR%\\System32\\icacls.exe","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"path":"%WINDIR%\\System32\\en-US\\icacls.exe.mui","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]},{"path":"%WINDIR%\\system32\\en-US\\NETMSG.DLL.mui","sources":[{"report_type":"sandbox","report_id":"58dcd65baac2ed2e2f6ff64b"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["58dcd65baac2ed2e2f6ff64b"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Ransom_CRYPDNC.A Sample 1ee580d60a43… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1ee580d60a43…. Malware family: Ransom_CRYPDNC.A. Threat score 100/100. 16/27 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1ee580d60a43a847140136874f2b8646a2de700457114c4df0e16170029cdb43"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom_CRYPDNC.A Sample 1ee580d60a43… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1ee580d60a43…. Malware family: Ransom_CRYPDNC.A. Threat score 100/100. 16/27 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1ee580d60a43a847140136874f2b8646a2de700457114c4df0e16170029cdb43"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom_CRYPDNC.A Sample 1ee580d60a43… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1ee580d60a43…. Malware family: Ransom_CRYPDNC.A. Threat score 100/100. 16/27 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]]