24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 825624d8a93c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 825624d8a93c…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc"],"about":{"@type":"SoftwareApplication","name":"9994ffa496ba04fff7ab1b26b662c8f8-sample.zip","applicationCategory":["peexe","executable"],"identifier":"825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":29},"behavioralIndicators":{"malicious":8,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7e9,"" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")26:T6f3,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")27:T845,Spawned process "cmd.exe" with commandline "/c "hostname > %TEMP%\TMPEC07.tmp"" (UID: 00019122-00002496) Spawned process "HOSTNAME.EXE" with commandline "hostname" (UID: 00019134-00002448) Spawned process "cmd.exe" with commandline "/c "whoami >> %TEMP%\TMPEC07.tmp"" (UID: 00019144-00002460) Spawned process "whoami.exe" with commandline "whoami" (UID: 00019147-00002452) Spawned process "cmd.exe" with commandline "/c "ver >> %TEMP%\TMPEC07.tmp"" (UID: 00019157-00002436) Spawned process "cmd.exe" with commandline "/c "ipconfig -all >> %TEMP%\TMPEC07.tmp"" (UID: 00019160-00002532) Spawned process "ipconfig.exe" with commandline "ipconfig -all" (UID: 00019163-00002600) Spawned process "cmd.exe" with commandline "/c "ping www.google.com >> %TEMP%\TMPEC07.tmp"" (UID: 00019180-00002536) Spawned process "PING.EXE" with commandline "ping www.google.com" (UID: 00019183-00002668) Spawned process "cmd.exe" with commandline "/c "query user >> %TEMP%\TMPEC07.tmp"" (UID: 00019498-00002700) Spawned process "cmd.exe" with commandline "/c "net user >> %TEMP%\TMPEC07.tmp"" (UID: 00019501-00002764) Spawned process "net.exe" with commandline "net user" (UID: 00019504-00002352) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 user" (UID: 00019507-00002792) Spawned process "cmd.exe" with commandline "/c "net view >> %TEMP%\TMPEC07.tmp"" (UID: 00019516-00002780) Spawned process "net.exe" with commandline "net view" (UID: 00019519-00002756) Spawned process "cmd.exe" with commandline "/c "net view /domain >> %TEMP%\TMPEC07.tmp"" (UID: 00019523-00002772) Spawned process "net.exe" with commandline "net view /domain" (UID: 00019527-00002604) Spawned process "cmd.exe" with commandline "/c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" >> %TEMP%\TMPEC07.tmp"" (UID: 00019533-00002664) Spawned process "reg.exe" with commandline "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"" (UID: 00019537-00002556) Spawned process "cmd.exe" with commandline "/c "tasklist /svc >> %TEMP%\TMPEC07.tmp"" (UID: 00019555-00002572)28:Tb45,"HOSTNAME.EXE" wrote bytes "4053127758581377186a1377653c14770000000000bf6d750000000056cc6d75000000007cca6d750000000037684a756a2c1477d62d14770000000020694a750000000029a66d7500000000a48d4a7500000000f70e6d7500000000" to virtual address "0x77261000" (part of module "NSI.DLL") "whoami.exe" wrote bytes "4053127758581377186a1377653c14770000000000bf6d750000000056cc6d75000000007cca6d750000000037684a756a2c1477d62d14770000000020694a750000000029a66d7500000000a48d4a7500000000f70e6d7500000000" to virtual address "0x77261000" (part of module "NSI.DLL") "ipconfig.exe" wrote bytes "4053127758581377186a1377653c14770000000000bf6d750000000056cc6d75000000007cca6d750000000037684a756a2c1477d62d14770000000020694a750000000029a66d7500000000a48d4a7500000000f70e6d7500000000" to virtual address "0x77261000" (part of module "NSI.DLL") "PING.EXE" wrote bytes "4053127758581377186a1377653c14770000000000bf6d750000000056cc6d75000000007cca6d750000000037684a756a2c1477d62d14770000000020694a750000000029a66d7500000000a48d4a7500000000f70e6d7500000000" to virtual address "0x77261000" (part of module "NSI.DLL") "net.exe" wrote bytes "4053127758581377186a1377653c14770000000000bf6d750000000056cc6d75000000007cca6d750000000037684a756a2c1477d62d14770000000020694a750000000029a66d7500000000a48d4a7500000000f70e6d7500000000" to virtual address "0x77261000" (part of module "NSI.DLL") "net1.exe" wrote bytes "4053127758581377186a1377653c14770000000000bf6d750000000056cc6d75000000007cca6d750000000037684a756a2c1477d62d14770000000020694a750000000029a66d7500000000a48d4a7500000000f70e6d7500000000" to virtual address "0x77261000" (part of module "NSI.DLL") "reg.exe" wrote bytes "4053127758581377186a1377653c14770000000000bf6d750000000056cc6d75000000007cca6d750000000037684a756a2c1477d62d14770000000020694a750000000029a66d7500000000a48d4a7500000000f70e6d7500000000" to virtual address "0x77261000" (part of module "NSI.DLL") "tasklist.exe" wrote bytes "4053127758581377186a1377653c14770000000000bf6d750000000056cc6d75000000007cca6d750000000037684a756a2c1477d62d14770000000020694a750000000029a66d7500000000a48d4a7500000000f70e6d7500000000" to virtual address "0x77261000" (part of module "NSI.DLL") "NETSTAT.EXE" wrote bytes "92e60f7779a81477be721477d62d14771de20f7705a21477bee30f77616f1477684112770050127700000000ad37ee758b2dee75b641ee7500000000" to virtual address "0x74751000" (part of module "WSHTCPIP.DLL") "NETSTAT.EXE" wrote bytes "7739107779a81477be721477d62d14771de20f7705a21477c868137757d11a77bee30f77616f1477684112770050127700000000ad37ee758b2dee75b641ee7500000000" to virtual address "0x74C71000" (part of module "WSHIP6.DLL") "NETSTAT.EXE" wrote bytes "4053127758581377186a1377653c14770000000000bf6d750000000056cc6d75000000007cca6d750000000037684a756a2c1477d62d14770000000020694a750000000029a66d7500000000a48d4a7500000000f70e6d7500000000" to virtual address "0x77261000" (part of module "NSI.DLL")29:Ta04,Spawned process "" (UID: 00018598-00000568) Spawned process "cmd.exe" with commandline "/c "hostname > %TEMP%\TMPEC07.tmp"" (UID: 00019122-00002496) Spawned process "HOSTNAME.EXE" with commandline "hostname" (UID: 00019134-00002448) Spawned process "cmd.exe" with commandline "/c "whoami >> %TEMP%\TMPEC07.tmp"" (UID: 00019144-00002460) Spawned process "whoami.exe" with commandline "whoami" (UID: 00019147-00002452) Spawned process "cmd.exe" with commandline "/c "ver >> %TEMP%\TMPEC07.tmp"" (UID: 00019157-00002436) Spawned process "cmd.exe" with commandline "/c "ipconfig -all >> %TEMP%\TMPEC07.tmp"" (UID: 00019160-00002532) Spawned process "ipconfig.exe" with commandline "ipconfig -all" (UID: 00019163-00002600) Spawned process "cmd.exe" with commandline "/c "ping www.google.com >> %TEMP%\TMPEC07.tmp"" (UID: 00019180-00002536) Spawned process "PING.EXE" with commandline "ping www.google.com" (UID: 00019183-00002668) Spawned process "cmd.exe" with commandline "/c "query user >> %TEMP%\TMPEC07.tmp"" (UID: 00019498-00002700) Spawned process "cmd.exe" with commandline "/c "net user >> %TEMP%\TMPEC07.tmp"" (UID: 00019501-00002764) Spawned process "net.exe" with commandline "net user" (UID: 00019504-00002352) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 user" (UID: 00019507-00002792) Spawned process "cmd.exe" with commandline "/c "net view >> %TEMP%\TMPEC07.tmp"" (UID: 00019516-00002780) Spawned process "net.exe" with commandline "net view" (UID: 00019519-00002756) Spawned process "cmd.exe" with commandline "/c "net view /domain >> %TEMP%\TMPEC07.tmp"" (UID: 00019523-00002772) Spawned process "net.exe" with commandline "net view /domain" (UID: 00019527-00002604) Spawned process "cmd.exe" with commandline "/c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" >> %TEMP%\TMPEC07.tmp"" (UID: 00019533-00002664) Spawned process "reg.exe" with commandline "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"" (UID: 00019537-00002556) Spawned process "cmd.exe" with commandline "/c "tasklist /svc >> %TEMP%\TMPEC07.tmp"" (UID: 00019555-00002572) Spawned process "tasklist.exe" with commandline "tasklist /svc" (UID: 00019561-00002564) Spawned process "cmd.exe" with commandline "/c "netstat -ano | find "TCP" >> %TEMP%\TMPEC07.tmp"" (UID: 00019635-00002872) Spawned process "NETSTAT.EXE" with commandline "netstat -ano" (UID: 00019639-00002892) Spawned process "find.exe" with commandline "find "TCP"" (UID: 00019642-00002900)2a:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==35:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790317572531,"unified_at":"2026-09-25T06:26:12.531Z","metadata":{"hashes":{"sha256":"825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc","sha1":"09c1756064f15fcdd29ff8f239b3d5dcc22ac492","md5":"911de8d67af652a87415f8c0a30688b2","sha512":"ca389dfc77e10f902718b0c7deafb80a1f7c5c301cbf77a4edac00dd71e8c145aaced821005e08cec9139cac4e1df80599d4a6bbb2db7729e26542d415396cfe","ssdeep":"3072:mvrUyleaDxy7IervMTqzubiB0lf5Nw3Q7zRM:mvr5y7IhTqzubi8TLBM","ssdeep_chunks":["3072:mvrUyle","3072:vrUylea","3072:rUyleaD","3072:UyleaDx","3072:yleaDxy","3072:leaDxy7","3072:eaDxy7I","3072:aDxy7Ie","3072:Dxy7Ier","3072:xy7Ierv","3072:y7IervM","3072:7IervMT","3072:IervMTq","3072:ervMTqz","3072:rvMTqzu","3072:vMTqzub","3072:MTqzubi","3072:TqzubiB","3072:qzubiB0","3072:zubiB0l","3072:ubiB0lf","3072:biB0lf5","3072:iB0lf5N","3072:B0lf5Nw","3072:0lf5Nw3","3072:lf5Nw3Q","3072:f5Nw3Q7","3072:5Nw3Q7z","3072:Nw3Q7zR","3072:w3Q7zRM","6144:mvrUyle","6144:vrUylea","6144:rUyleaD","6144:UyleaDx","6144:yleaDxy","6144:leaDxy7","6144:eaDxy7I","6144:aDxy7Ie","6144:Dxy7Ier","6144:xy7Ierv","6144:y7IervM","6144:7IervMT","6144:IervMTq","6144:ervMTqz","6144:rvMTqzu","6144:vMTqzub","6144:MTqzubi","6144:TqzubiB","6144:qzubiB0","6144:zubiB0l","6144:ubiB0lf","6144:biB0lf5","6144:iB0lf5N","6144:B0lf5Nw","6144:0lf5Nw3","6144:lf5Nw3Q","6144:f5Nw3Q7","6144:5Nw3Q7z","6144:Nw3Q7zR","6144:w3Q7zRM","3072:mvr5y7I","3072:vr5y7Ih","3072:r5y7IhT","3072:5y7IhTq","3072:y7IhTqz","3072:7IhTqzu","3072:IhTqzub","3072:hTqzubi","3072:Tqzubi8","3072:qzubi8T","3072:zubi8TL","3072:ubi8TLB","3072:bi8TLBM"],"imphash":"8811e5f10ca1b684a15ef9a8fc34ee45"},"file_info":{"file_name":"9994ffa496ba04fff7ab1b26b662c8f8-sample.zip","file_type":["peexe","executable"],"file_type_id":"exe","file_size":129024,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287929000,"last_seen":1664702347000,"last_multi_scan":1664702347000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":16,"suspicious_count":16,"malicious_count":8,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Joanap","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.nrtcx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.312283","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.DOL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.312283 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.NukeSped.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.NukeSped","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 0055e3da1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Banker.Win32.Alreay.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.ehvtix","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Dynamer.9130","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Downloader.Ratankba","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader/W32.Ratankba.129024","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_RATANKBA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_RATANKBA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Amonetize","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Alreay.Win32.30","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 35579-899-0040FB50\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018598-00000568-48372-12-00DC881E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018598-00000568-48372-33-00DCBA33\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018598-00000568-48372-667-00DCFB50","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00018598-00000568-48372-254-00DCA0B0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00018598-00000568-48372-302-00DD0271","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00018598-00000568-48372-278-00DC5550","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 35579-547-00401A90\n GetProcessHeap@KERNEL32.dll at 35579-546-004017D0\n GetProcessHeap@KERNEL32.DLL at 00018598-00000568-48372-123-00DD36E2\n GetProcessHeap@KERNEL32.DLL at 00018598-00000568-48372-367-00DC1A90\n GetProcessHeap@KERNEL32.DLL at 00018598-00000568-48372-366-00DC17D0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.eye-watch.in\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"54.225.94.231:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\TMPEC07.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c \"hostname > %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:20:00.781\n \"/c \"whoami >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:20:00.901\n \"/c \"ver >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:21:00.030\n \"/c \"ipconfig -all >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:21:00.060\n \"/c \"ping www.google.com >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:21:40.260\n \"/c \"query user >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:24:00.410\n \"/c \"net user >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:24:00.450\n \"/c \"net view >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:24:00.600\n \"/c \"net view /domain >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:24:00.670\n \"/c \"reg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:24:00.771\n \"/c \"tasklist /svc >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:24:00.991\n \"/c \"netstat -ano | find \"TCP\" >> %TEMP%\\TMPEC07.tmp\"\" on 2017-2-14.09:25:40.781","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"TMPEC07.tmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Winslui.exe\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Winslui.exe\\:Zone.Identifier:$DATA\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.google.com\"\n Pattern match: \"https://www.eye-watch.in/design/dfbox/list.jsp\"\n Pattern match: \"watch.in/design/dfbox/list.jsp\"\n Pattern match: \"https://www.eye-watch.in/design/dfbox/list.jsp?action=What&u=10418572156800\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc.exe.bin\" was detected as \"Microsoft Visual C++ 8\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00018598-00000568-00000105-46619515","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"reg.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"HOSTNAME.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"whoami.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ipconfig.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"NETSTAT.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"ipconfig.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"tasklist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to display shared resources","description":"Process \"net.exe\" with commandline \"net view\" (UID: 00019519-00002756)\n Process \"net.exe\" with commandline \"net view /domain\" (UID: 00019527-00002604)","origin":"Monitored Target","relevance":10,"id":"target-41","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"00900000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"net.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)\n \"tasklist.exe\" called \"OpenSCManager\" requesting access rights \"0X5\"","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"ipconfig.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_CONFIG\" (0X1) access rights\n \"ipconfig.exe\" called \"OpenService\" to access the \"NapAgent\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"ipconfig.exe\" called \"OpenService\" to access the \"NapAgent\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"\n \"ipconfig.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"NapAgent\"\n \"ipconfig.exe\" called \"ControlService\" and sent control code \"0X120\" to the service \"NapAgent\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Network Related","name":"Queries the logged on user, group or privileges using Whoami","description":"Process \"whoami.exe\" with commandline \"whoami\" (UID: 00019147-00002452)","origin":"Monitored Target","relevance":10,"id":"target-51","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping www.google.com\" (UID: 00019183-00002668)","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc.exe\" marked \"%TEMP%\\TMPEC07.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\TMPEC07.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesW\n GetTempPathW\n CopyFileW\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n CreateThread\n TerminateProcess\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n LoadLibraryA\n GetFileSize\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n CreateFileW\n CreateProcessW\n GetCommandLineW\n GetModuleHandleW\n WriteFile\n Sleep\n VirtualAlloc\n URLDownloadToFileW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"ipconfig.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"NETSTAT.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"find.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Winslui.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO TROJAN Unknown Backdoor SSL Cert (legitimate compromised site)\" (SID: 2824806, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"43/57 Antivirus vendors marked sample as malicious (75% detection rate)\n 18/42 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"43/57 Antivirus vendors marked sample as malicious (75% detection rate)\n 18/42 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"malicious","category":"Installation/Persistance","name":"Shedules a task to be executed at a specific time and date","description":"Process \"NETSTAT.EXE\" with commandline \"netstat -ano\" (UID: 00019639-00002892)","origin":"Monitored Target","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"54.225.94.231\" (ASN: 14618, Owner: Amazon.com, Inc.): ...\nURL: http://www.eye-watch.in/ (AV positives: 1/64 scanned on 02/14/2017 16:26:54)\n URL: http://www.eye-watch.in/design/fancybox/Pnf.action (AV positives: 2/65 scanned on 02/14/2017 03:58:07)\n URL: https://www.eye-watch.in/design/fancybox/Pnf.action (AV positives: 2/64 scanned on 02/13/2017 14:41:13)\n URL: http://www.eye-watch.in/jscroll/images/images.jsp?pagenum=1 (AV positives: 1/64 scanned on 02/13/2017 13:46:37)\n URL: http://www.eye-watch.in:443/ (AV positives: 1/64 scanned on 02/13/2017 13:46:18)\n File SHA256: bd2893d4997c4f0e523ded0cef7b98c72641b5377adccc38092312fa7174b84b (AV positives: 28/57 scanned on 03/23/2015 17:27:46)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$29","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Shedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Tries to display shared resources"},{"detail":"Queries the logged on user, group or privileges using Whoami"}],"sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]}]},"activity":{"stats":{"process_count":25,"spawned_processes_count":25,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":89,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":30,"files_deleted_count":0,"registry_keys_created_count":26,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":26,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"58a33784aac2ed5a3193e305","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["USA"],"submit_name":"9994ffa496ba04fff7ab1b26b662c8f8-sample.zip","analysis_start_time":"2017-02-14T18:01:36+00:00","indicators_count":{"informative":16,"suspicious":19,"malicious":9},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"54.225.94.231","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]}],"dns_resolutions":[{"domain":"www.eye-watch.in","address":"54.225.94.231","country":"United States","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}],"processes":[{"pid":568,"ppid":0,"name":"825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc.exe","command_line":"","normalized_path":"C:\\825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc.exe","uid":"00018598-00000568","icon":"$2a"},{"pid":2496,"ppid":568,"name":"cmd.exe","command_line":"/c \"hostname > %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019122-00002496","icon":"$2b"},{"pid":2448,"ppid":2496,"name":"HOSTNAME.EXE","command_line":"hostname","normalized_path":"%WINDIR%\\System32\\HOSTNAME.EXE","parent_uid":"00019122-00002496","uid":"00019134-00002448"},{"pid":2460,"ppid":568,"name":"cmd.exe","command_line":"/c \"whoami >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019144-00002460","icon":"$2c"},{"pid":2452,"ppid":2460,"name":"whoami.exe","command_line":"whoami","normalized_path":"%WINDIR%\\System32\\whoami.exe","parent_uid":"00019144-00002460","uid":"00019147-00002452"},{"pid":2436,"ppid":568,"name":"cmd.exe","command_line":"/c \"ver >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019157-00002436","icon":"$2d"},{"pid":2532,"ppid":568,"name":"cmd.exe","command_line":"/c \"ipconfig -all >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019160-00002532","icon":"$2e"},{"pid":2600,"ppid":2532,"name":"ipconfig.exe","command_line":"ipconfig -all","normalized_path":"%WINDIR%\\System32\\ipconfig.exe","parent_uid":"00019160-00002532","uid":"00019163-00002600"},{"pid":2536,"ppid":568,"name":"cmd.exe","command_line":"/c \"ping www.google.com >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019180-00002536","icon":"$2f"},{"pid":2668,"ppid":2536,"name":"PING.EXE","command_line":"ping www.google.com","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00019180-00002536","uid":"00019183-00002668"},{"pid":2700,"ppid":568,"name":"cmd.exe","command_line":"/c \"query user >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019498-00002700","icon":"$30"},{"pid":2764,"ppid":568,"name":"cmd.exe","command_line":"/c \"net user >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019501-00002764","icon":"$31"},{"pid":2352,"ppid":2764,"name":"net.exe","command_line":"net user","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00019501-00002764","uid":"00019504-00002352"},{"pid":2792,"ppid":2352,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 user","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00019504-00002352","uid":"00019507-00002792"},{"pid":2780,"ppid":568,"name":"cmd.exe","command_line":"/c \"net view >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019516-00002780","icon":"$32"},{"pid":2756,"ppid":2780,"name":"net.exe","command_line":"net view","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00019516-00002780","uid":"00019519-00002756"},{"pid":2772,"ppid":568,"name":"cmd.exe","command_line":"/c \"net view /domain >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019523-00002772","icon":"$33"},{"pid":2604,"ppid":2772,"name":"net.exe","command_line":"net view /domain","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00019523-00002772","uid":"00019527-00002604"},{"pid":2664,"ppid":568,"name":"cmd.exe","command_line":"/c \"reg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019533-00002664","icon":"$34"},{"pid":2556,"ppid":2664,"name":"reg.exe","command_line":"reg query \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\"","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00019533-00002664","uid":"00019537-00002556"},{"pid":2572,"ppid":568,"name":"cmd.exe","command_line":"/c \"tasklist /svc >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019555-00002572","icon":"$35"},{"pid":2564,"ppid":2572,"name":"tasklist.exe","command_line":"tasklist /svc","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00019555-00002572","uid":"00019561-00002564"},{"pid":2872,"ppid":568,"name":"cmd.exe","command_line":"/c \"netstat -ano | find \"TCP\" >> %TEMP%\\TMPEC07.tmp\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018598-00000568","uid":"00019635-00002872","icon":"$36"},{"pid":2892,"ppid":2872,"name":"NETSTAT.EXE","command_line":"netstat -ano","normalized_path":"%WINDIR%\\System32\\NETSTAT.EXE","parent_uid":"00019635-00002872","uid":"00019639-00002892"},{"pid":2900,"ppid":2872,"name":"find.exe","command_line":"find \"TCP\"","normalized_path":"%WINDIR%\\System32\\find.exe","parent_uid":"00019635-00002872","uid":"00019642-00002900"}],"all_imported_dlls":["dhcpcsvc6.dll","lpk.dll","gdi32.dll","sechost.dll","msasn1.dll","dsrole.dll","wbemcomn.dll","fastprox.dll","crypt32.dll","msctf.dll","dnsapi.dll","profapi.dll","cryptsp.dll","browcli.dll","wkscli.dll","logoncli.dll","webio.dll","rpcrt4.dll","QAGENT.DLL","netmsg.dll","framedynos.dll","snmpapi.dll","inetmib1.dll","ulib.dll","FWPUCLNT.DLL","winbrand.dll","NapiNSP.dll","samcli.dll","wbemprox.dll","apphelp.dll","shell32.dll","uxtheme.dll","QUTIL.DLL","mpr.dll","ntdsapi.dll","ntdll.dll","advapi32.dll","sspicli.dll","winnsi.dll","msvcrt.dll","oleaut32.dll","bcrypt.dll","gpapi.dll","WSHTCPIP.DLL","rasadhlp.dll","schannel.dll","ncrypt.dll","cryptbase.dll","wbemsvc.dll","kernel32.dll","dhcpcsvc.dll","RpcRtRemote.dll","srvcli.dll","usp10.dll","urlmon.dll","ws2_32.dll","wshqos.dll","rsaenh.dll","wmiutils.dll","iertutil.dll","ole32.dll","imm32.dll","secur32.dll","rpcss.dll","clbcatq.dll","winrnr.dll","wtsapi32.dll","winsta.dll","shlwapi.dll","nsi.dll","wship6.dll","credssp.dll","userenv.dll","version.dll","wevtapi.dll","dbghelp.dll","KernelBase.dll","winhttp.dll","user32.dll","IPHLPAPI.DLL","netapi32.dll","wininet.dll","mswsock.dll","bcryptprimitives.dll","nlaapi.dll","pnrpnsp.dll","netutils.dll","samlib.dll","cscapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"TMPEC07.tmp","sha256":"8debb0e488c9f973f598a3b16dfbfbd343438ef0f3ef6c0673f000165a8caabe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]}],"files_written":[{"path":"C:\\825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc.exe","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Winslui.exe","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"C:\\825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Winslui.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\HOSTNAME.EXE","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\en-US\\HOSTNAME.EXE.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\whoami.exe","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\en-US\\whoami.exe.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\en-US\\ipconfig.exe.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\en-US\\PING.EXE.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"PIPE\\samr","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\tasklist.exe","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\en-US\\tasklist.exe.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\NETSTAT.EXE","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\find.exe","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\en-US\\NETSTAT.EXE.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\en-US\\find.exe.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%WINDIR%\\system32\\en-US\\ulib.dll.mui","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"path":"%TEMP%\\TMPEC07.tmp","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\SHAS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\QECS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\RFC1156AGENT\\CURRENTVERSION\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\RFC1156AGENT\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\RFC1156AGENT\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"58a33784aac2ed5a3193e305"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["58a33784aac2ed5a3193e305"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 825624d8a93c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 825624d8a93c…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 825624d8a93c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 825624d8a93c…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/825624d8a93c88a811262bd32cc51e19538c5d65f6f9137e30e72c5de4f044cc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 825624d8a93c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 825624d8a93c…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]]