26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 33a60a16e50b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 33a60a16e50b…. Malware family: Trojan.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 13 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414"],"about":{"@type":"SoftwareApplication","name":"cm.exe","applicationCategory":["peexe","executable"],"identifier":"33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":26},"behavioralIndicators":{"malicious":13,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T792,Spawned process "cmd.exe" with commandline "/C sc stop VVS" (UID: 00042609-00003660) Spawned process "cmd.exe" with commandline "/C sc stop wscsvc" (UID: 00042617-00003600) Spawned process "cmd.exe" with commandline "/C sc stop WinDefend" (UID: 00042624-00003568) Spawned process "sc.exe" with commandline "sc stop VVS" (UID: 00042631-00002076) Spawned process "cmd.exe" with commandline "/C sc stop wuauserv" (UID: 00042637-00003668) Spawned process "cmd.exe" with commandline "/C sc stop BITS" (UID: 00042646-00003672) Spawned process "sc.exe" with commandline "sc stop wscsvc" (UID: 00042657-00003720) Spawned process "sc.exe" with commandline "sc stop WinDefend" (UID: 00042662-00003700) Spawned process "cmd.exe" with commandline "/C sc stop ERSvc" (UID: 00042663-00003712) Spawned process "cmd.exe" with commandline "/C sc stop WerSvc" (UID: 00042677-00003760) Spawned process "sc.exe" with commandline "sc stop wuauserv" (UID: 00042688-00003884) Spawned process "cmd.exe" with commandline "/C vssadmin.exe Delete Shadows /All /Quiet" (UID: 00042697-00003928) Spawned process "sc.exe" with commandline "sc stop ERSvc" (UID: 00042699-00003856) Spawned process "sc.exe" with commandline "sc stop BITS" (UID: 00042700-00003860) Spawned process "sc.exe" with commandline "sc stop WerSvc" (UID: 00042727-00004000) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} recoveryenabled No" (UID: 00042728-00003916) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00042746-00003804) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00042775-00003788) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00042777-00003844) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00042779-00003832)28:T7cd,Spawned process "" (UID: 00041778-00003496) Spawned process "cmd.exe" with commandline "/C sc stop VVS" (UID: 00042609-00003660) Spawned process "cmd.exe" with commandline "/C sc stop wscsvc" (UID: 00042617-00003600) Spawned process "cmd.exe" with commandline "/C sc stop WinDefend" (UID: 00042624-00003568) Spawned process "sc.exe" with commandline "sc stop VVS" (UID: 00042631-00002076) Spawned process "cmd.exe" with commandline "/C sc stop wuauserv" (UID: 00042637-00003668) Spawned process "cmd.exe" with commandline "/C sc stop BITS" (UID: 00042646-00003672) Spawned process "sc.exe" with commandline "sc stop wscsvc" (UID: 00042657-00003720) Spawned process "sc.exe" with commandline "sc stop WinDefend" (UID: 00042662-00003700) Spawned process "cmd.exe" with commandline "/C sc stop ERSvc" (UID: 00042663-00003712) Spawned process "cmd.exe" with commandline "/C sc stop WerSvc" (UID: 00042677-00003760) Spawned process "sc.exe" with commandline "sc stop wuauserv" (UID: 00042688-00003884) Spawned process "cmd.exe" with commandline "/C vssadmin.exe Delete Shadows /All /Quiet" (UID: 00042697-00003928) Spawned process "sc.exe" with commandline "sc stop ERSvc" (UID: 00042699-00003856) Spawned process "sc.exe" with commandline "sc stop BITS" (UID: 00042700-00003860) Spawned process "sc.exe" with commandline "sc stop WerSvc" (UID: 00042727-00004000) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} recoveryenabled No" (UID: 00042728-00003916) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00042746-00003804) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00042775-00003788) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00042777-00003844) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00042779-00003832)29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAB3d3dVVVUAAAAAAAAAAAB3d3d1VVVVVQAAAAAAAAB3d3d3VVVVVVVVAAAAAAAHd3d3dVVVVVVVVVAAAAAAd3d3d1VVVVVVVVVVAAAAB3d3d1VVVVVVVVVVVVAAAHd3d3VVVVVVVVVVVVVVAAB3d4hVVVVVVVVVVVVVVQAHd3ePdVVVVVVVVVVVVVVQB3d3j3VVVX+FVVVVVVVVUHd3d491VVX/hVVVVVVVVVV3d3ePdVVY+FVVVVVVVVVXd3d3j3VVf/dVVVVVVVVXd3d3d491V/91VVVVVVVVd3d3d3ePdVj4VVVVVVVVV3d3d3d3j3WP////////93d3d3d3d491j/////////h3d3d3d3ePdVj4VVVVVXd3d3d3d3d3j3VX/3VVVVd3d3d3d3d3d491VY/3VVd3d3d3d3d3d3ePdVV4+FV3d3d3d3d3d3d3j3VXd/+Hd3d3d3d3dwd3d493d3ePh3d3d3d3d3AHd3ePh3d3d3d3d3d3d3dwAHd3iHd3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3cAAAAAB3d3d3d3d3d3d3dwAAAAAAB3d3d3d3d3d3d3AAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAAd3d3d3d3AAAAAAD/wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==31:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==33:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==35:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==37:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791100991062,"unified_at":"2026-10-04T08:03:11.062Z","metadata":{"hashes":{"sha256":"33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414","sha1":"548058b2233b75cdfd964c1d7be5d2b80818131a","md5":"17f54288695fc46d11078ea493eb6626","sha512":"fde1afb841c64b3dfe1184991383d6fb7a9cdacebd74bbfeb2c72dd997e034399ad5e4cf1ebb709e98255898b017ed794500ff4a0bb67c28b459b9ac111d7044","ssdeep":"3072:K+ZEtkATAT0EcpkcBJo8Iwjquxj+McxIQuR2asLsZK7gXvzE+xMzk6:ZmYTKvBW7Gquxj+McxLughEVLEjg6","ssdeep_chunks":["3072:K+ZEtkA","3072:+ZEtkAT","3072:ZEtkATA","3072:EtkATAT","3072:tkATAT0","3072:kATAT0E","3072:ATAT0Ec","3072:TAT0Ecp","3072:AT0Ecpk","3072:T0Ecpkc","3072:0EcpkcB","3072:EcpkcBJ","3072:cpkcBJo","3072:pkcBJo8","3072:kcBJo8I","3072:cBJo8Iw","3072:BJo8Iwj","3072:Jo8Iwjq","3072:o8Iwjqu","3072:8Iwjqux","3072:Iwjquxj","3072:wjquxj+","3072:jquxj+M","3072:quxj+Mc","3072:uxj+Mcx","3072:xj+McxI","3072:j+McxIQ","3072:+McxIQu","3072:McxIQuR","3072:cxIQuR2","3072:xIQuR2a","3072:IQuR2as","3072:QuR2asL","3072:uR2asLs","3072:R2asLsZ","3072:2asLsZK","3072:asLsZK7","3072:sLsZK7g","3072:LsZK7gX","3072:sZK7gXv","3072:ZK7gXvz","3072:K7gXvzE","3072:7gXvzE+","3072:gXvzE+x","3072:XvzE+xM","3072:vzE+xMz","3072:zE+xMzk","3072:E+xMzk6","6144:K+ZEtkA","6144:+ZEtkAT","6144:ZEtkATA","6144:EtkATAT","6144:tkATAT0","6144:kATAT0E","6144:ATAT0Ec","6144:TAT0Ecp","6144:AT0Ecpk","6144:T0Ecpkc","6144:0EcpkcB","6144:EcpkcBJ","6144:cpkcBJo","6144:pkcBJo8","6144:kcBJo8I","6144:cBJo8Iw","6144:BJo8Iwj","6144:Jo8Iwjq","6144:o8Iwjqu","6144:8Iwjqux","6144:Iwjquxj","6144:wjquxj+","6144:jquxj+M","6144:quxj+Mc","6144:uxj+Mcx","6144:xj+McxI","6144:j+McxIQ","6144:+McxIQu","6144:McxIQuR","6144:cxIQuR2","6144:xIQuR2a","6144:IQuR2as","6144:QuR2asL","6144:uR2asLs","6144:R2asLsZ","6144:2asLsZK","6144:asLsZK7","6144:sLsZK7g","6144:LsZK7gX","6144:sZK7gXv","6144:ZK7gXvz","6144:K7gXvzE","6144:7gXvzE+","6144:gXvzE+x","6144:XvzE+xM","6144:vzE+xMz","6144:zE+xMzk","6144:E+xMzk6","3072:ZmYTKvB","3072:mYTKvBW","3072:YTKvBW7","3072:TKvBW7G","3072:KvBW7Gq","3072:vBW7Gqu","3072:BW7Gqux","3072:W7Gquxj","3072:7Gquxj+","3072:Gquxj+M","3072:xj+McxL","3072:j+McxLu","3072:+McxLug","3072:McxLugh","3072:cxLughE","3072:xLughEV","3072:LughEVL","3072:ughEVLE","3072:ghEVLEj","3072:hEVLEjg","3072:EVLEjg6"],"imphash":"43945fc26bf15c2127877ff0f235e9c2"},"file_info":{"file_name":"cm.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":223232,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1510613901000,"last_seen":1661609129000,"last_multi_scan":1661609129000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":13,"malicious_count":13,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Sagecrypt.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1210380","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Symmi.67059","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Symmi.67059 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.GLYG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.SuspectCRC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005128031 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Fury.op","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-GIT!17F54288695F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Fury.euyglc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.Cryptomix.S1645696","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-ESJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Fury.223232","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.5642156E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.5642156E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Fury","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 2707-1199-558339EC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 2707-892-5582A051\n GetVersionExA@KERNEL32.dll at 2707-724-55822954","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"SHGetDiskFreeSpaceExA@SHELL32.dll at 2707-892-5582A051","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"DBWinMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"CE7225ED_offset\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\CE7225ED_offset\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C sc stop VVS\" on 2017-11-13.14:48:37.766\n \"/C sc stop wscsvc\" on 2017-11-13.14:48:37.846\n \"/C sc stop WinDefend\" on 2017-11-13.14:48:37.936\n \"/C sc stop wuauserv\" on 2017-11-13.14:48:38.056\n \"/C sc stop BITS\" on 2017-11-13.14:48:38.196\n \"/C sc stop ERSvc\" on 2017-11-13.14:48:38.347\n \"/C sc stop WerSvc\" on 2017-11-13.14:48:38.487\n \"/C vssadmin.exe Delete Shadows /All /Quiet\" on 2017-11-13.14:48:38.687\n \"/C bcdedit /set {default} recoveryenabled No\" on 2017-11-13.14:48:38.988\n \"/C bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2017-11-13.14:48:39.188","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"yZw6snqBQ28DAzu.exe\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"DOS executable (COM)\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"dskCEJ.exe\" has type \"data\"\n \"Tmg2wsFHYf9ioO.doc\" has type \"data\"\n \"B63A3C1E0B4E12BE65F4FB7A0E7EF706.XZZX\" has type \"data\"\n \"81F26D4A2ED18E80CF39057130B272C8.XZZX\" has type \"data\"\n \"_HELP_INSTRUCTION.TXT\" has type \"data\"\n \"425E581015EB7AE047AF653519035F28.XZZX\" has type \"data\"\n \"51041E3931D498886D2D000534037CD0.XZZX\" has type \"data\"\n \"5yqb2pxbZ.txt\" has type \"data\"\n \"F37D0CD4174E716846FECF271A6655B0.XZZX\" has type \"data\"\n \"76A1A560023E6EB0E3E6398E08D452F8.XZZX\" has type \"data\"\n \"383C13901A8C3D00402E4BBE1E122148.XZZX\" has type \"data\"\n \"3A8401DF1A924D1D92F54B091E273165.XZZX\" has type \"data\"\n \"4224124C267EB29CC90C94072A1596E4.XZZX\" has type \"data\"\n \"693DB49442B32A0C97289D0A44D20E54.XZZX\" has type \"data\"\n \"3AB4D6B72D9E7243E5A807312FAD568B.XZZX\" has type \"Dyalog APL\"\n \"5C4EFD480AAB7F8569B551680D5063CD.XZZX\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\System32\\en-US\\setupapi.dll.mui\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\oleaccrc.dll\"\n \"\" touched file \"%WINDIR%\\System32\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\propsys.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.dll at 2707-892-5582A051","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"sc.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"sc.exe\" called \"OpenService\" to access the \"VVS\" service\n \"sc.exe\" called \"OpenService\" to access the \"wscsvc\" service requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"WinDefend\" service\n \"sc.exe\" called \"OpenService\" to access the \"wuauserv\" service requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"ERSvc\" service\n \"sc.exe\" called \"OpenService\" to access the \"BITS\" service requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"WerSvc\" service requesting \"SERVICE_STOP\" (0X20) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"BITS\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WerSvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"dH1rDN9f9.doc\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"00FFCE7225ED\"; Value: \"\"C:\\33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414.exe\"\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"BCCE7225ED\"; Value: \"\"%ALLUSERSPROFILE%\\BCCE7225ED.exe\"\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"*BCCE7225ED\"; Value: \"\"%ALLUSERSPROFILE%\\BCCE7225ED.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 532 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n RegOpenKeyExA\n RegCreateKeyA\n GetDriveTypeW\n GetTempPathA\n FindResourceExW\n OutputDebugStringA\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetModuleHandleA\n TerminateProcess\n LoadLibraryW\n GetTickCount\n GetVersionExA\n GetStartupInfoW\n GetProcAddress\n CreateFileW\n GetCommandLineA\n GetModuleHandleW\n WriteFile\n Sleep","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%ALLUSERSPROFILE%\\BCCE7225ED.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/C bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00042746-00003804)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00042775-00003788)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/67 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/67 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"/C bcdedit /set {default} recoveryenabled No\" (UID: 00042728-00003916)\n Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00042777-00003844)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00042779-00003832)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_HELP_INSTRUCTION.TXT\" which has been seen in the context of ransomware (Indicator: instruction.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wscsvc\" (Indicator: \"wscsvc\")\n \"wuauserv\" (Indicator: \"wuauserv\")\n \"/C sc stop wscsvc\" (Indicator: \"wscsvc\")\n \"/C sc stop wuauserv\" (Indicator: \"wuauserv\")\n \"sc stop wscsvc\" (Indicator: \"wscsvc\")\n \"sc stop wuauserv\" (Indicator: \"wuauserv\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"System Security","name":"Requested access to a critical system service","description":"\"sc.exe\" called \"OpenService\" to access the \"wscsvc\" service (\"Windows Security Center\") requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"WinDefend\" service (\"Windows Defender\")\n \"sc.exe\" called \"OpenService\" to access the \"wuauserv\" service (\"Windows Update\") requesting \"SERVICE_STOP\" (0X20) access rights","origin":"API Call","relevance":10,"id":"api-79","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"System Security","name":"Sent a control code to a critical system service","description":"\"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\" (\"Windows Security Center\")\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\" (\"Windows Defender\")\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\" (\"Windows Update\")","origin":"API Call","relevance":10,"id":"api-78","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"System Security","name":"Tries to disable/delete the windows firewall","description":"Process \"sc.exe\" with commandline \"sc stop WinDefend\" (UID: 00042662-00003700)","origin":"Monitored Target","relevance":10,"id":"target-18","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414.exe:Zone.Identifier\"\n \"\" checked file \"%ALLUSERSPROFILE%\\BCCE7225ED.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$28","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]}]},"activity":{"stats":{"process_count":21,"spawned_processes_count":21,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":54,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":107,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5a0a20727ca3e177326b18f3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","submit_name":"cm.exe","analysis_start_time":"2017-11-13T23:45:19+00:00","indicators_count":{"informative":10,"suspicious":16,"malicious":15},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}],"processes":[{"pid":3496,"ppid":0,"name":"33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414.exe","command_line":"","sha256":"33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414","normalized_path":"C:\\33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414.exe","uid":"00041778-00003496","icon":"$29"},{"pid":3660,"ppid":3496,"name":"cmd.exe","command_line":"/C sc stop VVS","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041778-00003496","uid":"00042609-00003660","icon":"$2a"},{"pid":2076,"ppid":3660,"name":"sc.exe","command_line":"sc stop VVS","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00042609-00003660","uid":"00042631-00002076","icon":"$2b"},{"pid":3600,"ppid":3496,"name":"cmd.exe","command_line":"/C sc stop wscsvc","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041778-00003496","uid":"00042617-00003600","icon":"$2c"},{"pid":3720,"ppid":3600,"name":"sc.exe","command_line":"sc stop wscsvc","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00042617-00003600","uid":"00042657-00003720","icon":"$2d"},{"pid":3568,"ppid":3496,"name":"cmd.exe","command_line":"/C sc stop WinDefend","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041778-00003496","uid":"00042624-00003568","icon":"$2e"},{"pid":3700,"ppid":3568,"name":"sc.exe","command_line":"sc stop WinDefend","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00042624-00003568","uid":"00042662-00003700","icon":"$2f"},{"pid":3668,"ppid":3496,"name":"cmd.exe","command_line":"/C sc stop wuauserv","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041778-00003496","uid":"00042637-00003668","icon":"$30"},{"pid":3884,"ppid":3668,"name":"sc.exe","command_line":"sc stop wuauserv","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00042637-00003668","uid":"00042688-00003884","icon":"$31"},{"pid":3672,"ppid":3496,"name":"cmd.exe","command_line":"/C sc stop BITS","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041778-00003496","uid":"00042646-00003672","icon":"$32"},{"pid":3860,"ppid":3672,"name":"sc.exe","command_line":"sc stop BITS","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00042646-00003672","uid":"00042700-00003860","icon":"$33"},{"pid":3712,"ppid":3496,"name":"cmd.exe","command_line":"/C sc stop ERSvc","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041778-00003496","uid":"00042663-00003712","icon":"$34"},{"pid":3856,"ppid":3712,"name":"sc.exe","command_line":"sc stop ERSvc","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00042663-00003712","uid":"00042699-00003856","icon":"$35"},{"pid":3760,"ppid":3496,"name":"cmd.exe","command_line":"/C sc stop WerSvc","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041778-00003496","uid":"00042677-00003760","icon":"$36"},{"pid":4000,"ppid":3760,"name":"sc.exe","command_line":"sc stop WerSvc","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00042677-00003760","uid":"00042727-00004000","icon":"$37"},{"pid":3928,"ppid":3496,"name":"cmd.exe","command_line":"/C vssadmin.exe Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041778-00003496","uid":"00042697-00003928","icon":"$38"},{"pid":3832,"ppid":3928,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00042697-00003928","uid":"00042779-00003832"},{"pid":3916,"ppid":3496,"name":"cmd.exe","command_line":"/C bcdedit /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041778-00003496","uid":"00042728-00003916","icon":"$39"},{"pid":3844,"ppid":3916,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00042728-00003916","uid":"00042777-00003844"},{"pid":3804,"ppid":3496,"name":"cmd.exe","command_line":"/C bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041778-00003496","uid":"00042746-00003804","icon":"$3a"},{"pid":3788,"ppid":3804,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00042746-00003804","uid":"00042775-00003788"}],"all_imported_dlls":["oleacc.dll","imm32.dll","uxtheme.dll","mpr.dll","urlmon.dll","wininet.dll","winbrand.dll","atl.dll","vsstrace.dll","lpk.dll","msvcrt.dll","advapi32.dll","oleaut32.dll","iertutil.dll","profapi.dll","vssapi.dll","cfgmgr32.dll","credssp.dll","ntdll.dll","KernelBase.dll","msctf.dll","cryptbase.dll","clbcatq.dll","ieframe.dll","user32.dll","sspicli.dll","oleaccrc.dll","ntmarta.dll","vss_ps.dll","usp10.dll","sechost.dll","ole32.dll","devobj.dll","rpcss.dll","msasn1.dll","Wldap32.dll","userenv.dll","cryptsp.dll","crypt32.dll","kernel32.dll","gdi32.dll","shell32.dll","pdh.dll","setupapi.dll","RpcRtRemote.dll","propsys.dll","apphelp.dll","comdlg32.dll","shlwapi.dll","comctl32.dll","rpcrt4.dll","secur32.dll","rsaenh.dll","psapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"F06C3C509054X0B7D28ZCDDBB17087B9C3E.XZZX","sha256":"71d8f0c8bf0a92363dc6b5ef2ac8befc1f7c04ded1a8969a1f95e24dc3f6cbb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"14bc69426a22f87161a4ddb05ceb0075_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"6dad3752e0efa7037a9bc60cea1ee7a85f38f5794a94e1c227927da866504402","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"091FBF0047A83FBE1DDFB7804B9C2406.XZZX","sha256":"8688505994ca8c6fa04c75255774f2ec045daa3f354e021acece1e293e36059b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"1344EE1D42323AB4F2CEC853454A1EFC.XZZX","sha256":"b6fa8a49a2815a4b1c513fdeb461262b9c26cee2d98e18292bbe1d4a6c53533b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"2FAB8C8E2F889D67EE4891D6336C81AF.XZZX","sha256":"cac425e29fcb240df713d960c7a25ca8ffa693ef29965e406d4d2367644edb5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"3948B40602F19C8A5C330B5D06C580D2.XZZX","sha256":"b6f32a413f3df40cb5ecc7cea98ae4d05d1516c1b5bd2200e3aa5cd73a4d6dfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"43419C2E2855E0D011AC3FB22C59C518.XZZX","sha256":"35fee2745f5c2f22ec7e790aae221dc18c7b53ca00f97a09037b5a317662ea18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"5F1DEDA635C5CE81F847A88238DDB2C9.XZZX","sha256":"4a4f5a4c06dd2e29fa0faaaf9d3e4e5693d78aa321d0064dc44bbe3194c714d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"A7EC5CD23B069DDA7F6AF96E3EAA8222.XZZX","sha256":"bafedf739c0f36fd3cd7cf687ad9fafcbab1da8a5f85107a76a5c905d204f7e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"_HELP_INSTRUCTION.TXT","sha256":"f9dd6f3c342fbce15e5566e3da805e600c8c15a4f181024d6e9daaba3177ef96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"C9D0519824AED7282F3B59F627C6BB70.XZZX","sha256":"b7adce9bb3cefdff0252136b6b9ed1ef41ffdb10c8ba0f37ab67a3218fca8f87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"F6DEB74007FAC0B04CCABA600B22A4F8.XZZX","sha256":"1ea17d7b76c70821fcca2a40b900890129a6495ff4b719ee420fb4251e4a3419","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"boot.sdi","sha256":"9156c2c4371ce7110132bd443536fafcdd86495f3dffc5259f756d2d61a1246b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"59D9C8A434500C33A545CC1C37E3F07B.XZZX","sha256":"2150af00ffcea0fcd1de42eddacb6b15a768dc18a1e7eee6a849c1b368d0a83a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"06c75b31c43f7f75ae4b098291f3102a5b0e469efcf454812415218f7246bd05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"dH1rDN9f9.doc","sha256":"7aab56244a892f4fbaff799d11490b7fe997902599de165da6f4f848419dfe29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"3ac6b8375f70c76225500d66796ea8b4f3052b5455a91bc25938cc8ec6a1e3d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"dskCEJ.exe","sha256":"326909f0dd1e3a6767f7da8ebc5d498ccbe46554bc39f2d7dc19ade11d9f603a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"6ba7e93960f8d51a6d07b5e413bcb03a65b4f809ed17268039fa817599453e8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\emf","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\Folder","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\en-US\\sc.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%ALLUSERSPROFILE%\\BCCE7225ED.exe","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%ALLUSERSPROFILE%\\BCCE7225ED.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%ALLUSERSPROFILE%\\F06C3C509054X0B7D28ZCDDBB17087B9C3E.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\1510613148226$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\1510613148226$OK","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414.exe","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\0Nt.SOR","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\btow9Dbr6Tjh3.5gu","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\F6DEB74007FAC0B04CCABA600B22A4F8.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\PH21lsIaslHNQLQThZTM.l4k","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\yu9XhZvHUBnkN76NZw1wDhOB.tZA","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\C9D0519824AED7282F3B59F627C6BB70.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\DgjBlyGYT.DYk","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\bnBGEIb8l.NQl","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\$Recycle.Bin\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\lO7mqxSu\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\Documents and Settings\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\MSOCache\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\MSOCache\\All Users\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\PerfLogs\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\PerfLogs\\Admin\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%PROGRAMFILES%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\Recovery\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\Recovery\\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\XeKeB\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\System Volume Information\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\Users\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%ALLUSERSPROFILE%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\NTUSER.DAT.LOG2","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\3948B40602F19C8A5C330B5D06C580D2.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\14bc69426a22f87161a4ddb05ceb0075_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"C:\\Users\\59D9C8A434500C33A545CC1C37E3F07B.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\091FBF0047A83FBE1DDFB7804B9C2406.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\2FAB8C8E2F889D67EE4891D6336C81AF.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\A7EC5CD23B069DDA7F6AF96E3EAA8222.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\43419C2E2855E0D011AC3FB22C59C518.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Downloads\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Favorites\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Links\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Local Settings\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%LOCALAPPDATA%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\NetHood\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Network Shortcuts\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\PrintHood\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Printer Shortcuts\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Recent\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Saved Games\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\SendTo\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\1344EE1D42323AB4F2CEC853454A1EFC.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\SendTo\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Start Menu\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Templates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Templates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\5F1DEDA635C5CE81F847A88238DDB2C9.XZZX","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\ntuser.ini","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\AppData\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Contacts\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Cookies\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Documents\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Documents\\My Music\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Music\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Documents\\My Pictures\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Pictures\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Documents\\My Videos\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Videos\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Documents\\Visual Studio 2008\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"path":"%USERPROFILE%\\Documents\\Visual Studio 2008\\Templates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"CE7225ED_offset","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CE7225ED_offset","sources":[{"report_type":"sandbox","report_id":"5a0a20727ca3e177326b18f3"}]}]}},"report_ids":{"sandbox_job_ids":["5a0a20727ca3e177326b18f3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 33a60a16e50b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 33a60a16e50b…. Malware family: Trojan.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 13 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 33a60a16e50b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 33a60a16e50b…. Malware family: Trojan.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 13 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/33a60a16e50b8df2a731023951475ff0f973fc66334d2cfa6ce30aa36bb36414"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 33a60a16e50b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 33a60a16e50b…. Malware family: Trojan.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 13 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]]