24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T479,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TROJ_EVNYCA.A Sample 95192de1f323… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 95192de1f323…. Malware family: TROJ_EVNYCA.A. Threat score 100/100. 20/27 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a","keywords":["Malicious","TROJ_EVNYCA.A","malware analysis","sandbox report","threat intelligence","95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TROJ_EVNYCA.A","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T921,Heuristic match: "tools.google.com" Heuristic match: "*.google.com" Heuristic match: "*.android.com" Heuristic match: "*.appengine.google.com" Heuristic match: "*.cloud.google.com" Heuristic match: "*.db833953.google.cn" Heuristic match: "*.gcp.gvt2.com" Heuristic match: "*.google-analytics.com" Heuristic match: "*.google.ca" Heuristic match: "*.google.cl" Heuristic match: "*.google.co.in" Heuristic match: "*.google.co.jp" Heuristic match: "*.google.co.uk" Heuristic match: "*.google.com.ar" Heuristic match: "*.google.com.au" Heuristic match: "*.google.com.br" Heuristic match: "*.google.com.co" Heuristic match: "*.google.com.mx" Heuristic match: "*.google.com.tr" Heuristic match: "*.google.com.vn" Heuristic match: "*.google.de" Heuristic match: "*.google.es" Heuristic match: "*.google.fr" Heuristic match: "*.google.hu" Heuristic match: "*.google.it" Heuristic match: "*.google.nl" Heuristic match: "*.google.pl" Heuristic match: "*.google.pt" Heuristic match: "*.googleadapis.com" Heuristic match: "*.googleapis.cn" Heuristic match: "*.googlecommerce.com" Heuristic match: "*.googlevideo.com" Heuristic match: "*.gstatic.cn" Heuristic match: "*.gstatic.com" Heuristic match: "*.gvt1.com" Heuristic match: "*.gvt2.com" Heuristic match: "*.metric.gstatic.com" Heuristic match: "*.urchin.com" Heuristic match: "*.url.google.com" Heuristic match: "*.youtube-nocookie.com" Heuristic match: "*.youtube.com" Heuristic match: "*.youtubeeducation.com" Heuristic match: "*.ytimg.com" Heuristic match: "android.clients.google.com" Heuristic match: "android.com" Heuristic match: "developer.android.google.cn" Heuristic match: "developers.android.google.cn" Heuristic match: "google-analytics.com" Heuristic match: "google.com" Heuristic match: "googlecommerce.com" Heuristic match: "source.android.google.cn" Heuristic match: "urchin.com" Heuristic match: "youtube.com" Heuristic match: "youtubeeducation.com" Pattern match: "http://pki.google.com/GIAG2.crt0+" Pattern match: "http://clients1.google.com/ocsp0" Pattern match: "http://pki.google.com/GIAG2.crl0" Pattern match: "http://g.symcd.com0" Pattern match: "http://g.symcb.com/crls/gtglobal.crl0" Pattern match: "http://crl.geotrust.com/crls/secureca.crl0N" Pattern match: "https://www.geotrust.com/resources/repository0"26:T429,Found string "FlsSetValue" (Source: 95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe.bin, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe.bin, API is part of module: KERNELBASE.DLL) Found string "GetProcessWindowStation" (Source: 95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe.bin, API is part of module: USER32.DLL) Found string "GetUserObjectInformationA" (Source: 95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe.bin, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe.bin, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: 95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe.bin, API is part of module: USER32.DLL) Found string "MessageBoxA" (Source: 95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe.bin, API is part of module: USER32.DLL)27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790727789989,"unified_at":"2026-09-30T00:23:09.989Z","metadata":{"hashes":{"sha256":"95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a","sha1":"c3a7229da459252f12205fbe55a438f2249654bb","md5":"fc0a9850f7b6a91f7757d64c86cfc141","sha512":"7808c107ec754a9d54357b92bd933b0b60a6d5ea4cc0e1b6387168f94feb550d385f741f8939b7cb1bf9845b9f793611ad136fb49f40826d5e65602a434052e9","ssdeep":"3072:5Lik1TCq555SL5WY4puel/2ns2lLm5qgpbhW630X:5Likt5YL5Wx2ns2NmIgu","ssdeep_chunks":["3072:5Lik1TC","3072:Lik1TCq","3072:ik1TCq5","3072:k1TCq55","3072:1TCq555","3072:TCq555S","3072:Cq555SL","3072:q555SL5","3072:555SL5W","3072:55SL5WY","3072:5SL5WY4","3072:SL5WY4p","3072:L5WY4pu","3072:5WY4pue","3072:WY4puel","3072:Y4puel/","3072:4puel/2","3072:puel/2n","3072:uel/2ns","3072:el/2ns2","3072:l/2ns2l","3072:/2ns2lL","3072:2ns2lLm","3072:ns2lLm5","3072:s2lLm5q","3072:2lLm5qg","3072:lLm5qgp","3072:Lm5qgpb","3072:m5qgpbh","3072:5qgpbhW","3072:qgpbhW6","3072:gpbhW63","3072:pbhW630","3072:bhW630X","6144:5Lik1TC","6144:Lik1TCq","6144:ik1TCq5","6144:k1TCq55","6144:1TCq555","6144:TCq555S","6144:Cq555SL","6144:q555SL5","6144:555SL5W","6144:55SL5WY","6144:5SL5WY4","6144:SL5WY4p","6144:L5WY4pu","6144:5WY4pue","6144:WY4puel","6144:Y4puel/","6144:4puel/2","6144:puel/2n","6144:uel/2ns","6144:el/2ns2","6144:l/2ns2l","6144:/2ns2lL","6144:2ns2lLm","6144:ns2lLm5","6144:s2lLm5q","6144:2lLm5qg","6144:lLm5qgp","6144:Lm5qgpb","6144:m5qgpbh","6144:5qgpbhW","6144:qgpbhW6","6144:gpbhW63","6144:pbhW630","6144:bhW630X","3072:5Likt5Y","3072:Likt5YL","3072:ikt5YL5","3072:kt5YL5W","3072:t5YL5Wx","3072:5YL5Wx2","3072:YL5Wx2n","3072:L5Wx2ns","3072:5Wx2ns2","3072:Wx2ns2N","3072:x2ns2Nm","3072:2ns2NmI","3072:ns2NmIg","3072:s2NmIgu"],"imphash":"46dadc708878a2da9ee7cbac099ffe9e"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":159744,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1523317396000,"last_seen":1686327322000,"last_multi_scan":1686327322000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["nimbus","ricochetchollima","targeted","tiggre","exploit","maldoc"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":6},"sandbox_signatures":{"informative_count":12,"suspicious_count":8,"malicious_count":4,"total":24},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Reloaderx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Dropper]/Win32.Demp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1360636","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Midie.83000","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Malear-5900669-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Midie.83000 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.DLRP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Injector.avj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.adrpt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXES-WS!FC0A9850F7B6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Demp.ekfxkf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.159744.BWK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_EVNYCA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_EVNYCA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanDownloader.Alien","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Demp.Win32.2346","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TROJ_EVNYCA.A","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"172.217.12.238:443\"\n \"216.58.213.142:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"e:\\Happy\\Work\\Source\\version 12\\T+M\\Result\\DocPrint.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\5170101-2016년 및 2017년 對南분야 비교.hwp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"wscript.exe\" (UID: 00019578-00003580)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"5170101-2016년 및 2017년 對南분야 비교.hwp\" has type \"Hangul (Korean) Word Processor File 5.x\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\System32\\wscript.exe\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\wscript.exe.mui\"\n \"\" touched file \"%WINDIR%\\system32\\en\\wscript.exe.mui\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"wscript.exe\" touched file \"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_en-us_020378a8991bbcc2\\comctl32.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"*.youtube-nocookie.com\" (Indicator: \"youtube\")\n \"*.youtube.com\" (Indicator: \"youtube\")\n \"*.youtubeeducation.com\" (Indicator: \"youtube\")\n \"youtube.com\" (Indicator: \"youtube\")\n \"youtubeeducation.com\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.85843632344","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\wscript.exe\", Handle: 268)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n CreateRemoteThread\n LockResource\n GetCommandLineW\n UnhandledExceptionFilter\n GetStartupInfoW\n GetProcAddress\n VirtualAllocEx\n WriteFile\n GetTempPathW\n GetStartupInfoA\n GetModuleHandleW\n WriteProcessMemory\n TerminateProcess\n CreateProcessA\n FindResourceW\n CreateFileW\n Sleep\n CreateFileA\n GetTickCount\n VirtualAlloc\n ShellExecuteW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$26","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/65 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"52/65 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 268)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 268)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 268)\n \"\" wrote 84556 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 268)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"korean_doc_campaign\" classified file \"95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe.bin\" as \"exploit\" based on indicators: \"e:\\Happy\\Work\\Source\\version 12\\T+M\\Result\\DocPrint.pdb\" (Reference: http://blog.talosintelligence.com/2017/02/korean-maldoc.html, Author: Marc Rivero | Hybrid Analysis)\n YARA signature \"korean_doc_campaign\" classified file \"all.bstring\" as \"exploit\" based on indicators: \"e:\\Happy\\Work\\Source\\version 12\\T+M\\Result\\DocPrint.pdb\" (Reference: http://blog.talosintelligence.com/2017/02/korean-maldoc.html, Author: Marc Rivero | Hybrid Analysis)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"wscript.exe\" (UID: 00010125-00002056)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00009362-00003116-50424-244-01006387","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"71116d007a3b6c00ab8b02007f950200fc8c0200729602006cc805001ecd69007d266900\" to virtual address \"0x777E07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":50,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":23,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["nimbus","ricochetchollima","targeted","tiggre","exploit","maldoc"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"5bdf38817ca3e178871fa82c","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe","analysis_start_time":"2018-11-04T19:20:58+00:00","indicators_count":{"informative":9,"suspicious":8,"malicious":7},"tags":["Extracted Files","Sample Crashed","Sample not shared","TOR analysis"],"is_in_unified_schema":true},{"id":"5acbfa937ca3e12c8e700563","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe","analysis_start_time":"2018-04-10T00:43:02+00:00","indicators_count":{"informative":11,"suspicious":4,"malicious":7},"tags":["Network Traffic","Extracted Files","Sample Crashed","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.217.12.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"address":"216.58.213.142","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}],"processes":[{"pid":2752,"ppid":0,"name":"95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe","command_line":"","sha256":"95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a","normalized_path":"C:\\95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a.exe","uid":"00019380-00002752","icon":"$27"},{"pid":3580,"ppid":2752,"name":"wscript.exe","command_line":"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00019380-00002752","uid":"00019578-00003580"}],"all_imported_dlls":["gdi32.dll","comctl32.dll","ntmarta.dll","Wldap32.dll","crypt32.dll","ntdll.dll","kernel32.dll","shlwapi.dll","rpcss.dll","oleaut32.dll","advapi32.dll","urlmon.dll","msasn1.dll","ole32.dll","user32.dll","clbcatq.dll","version.dll","lpk.dll","cryptbase.dll","dwmapi.dll","msctf.dll","rpcrt4.dll","propsys.dll","profapi.dll","wshext.dll","KernelBase.dll","shell32.dll","usp10.dll","uxtheme.dll","apphelp.dll","wininet.dll","iertutil.dll","msvcrt.dll","imm32.dll","sechost.dll","sspicli.dll","devobj.dll","normaliz.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","setupapi.dll","cfgmgr32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","userenv.dll","api-ms-win-downlevel-version-l1-1-0.dll","wow64cpu.dll","shdocvw.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wow64.dll","wow64win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"5170101-2016ë ë° 2017ë å°åë¶ì¼ ë¹êµ.hwp","sha256":"29430240cb59a12fcde8e4153c0859c90d5a928503a1ca05433f08a7b3c50bf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"name":"5170101-2016#Ub144 #Ubc0f 2017#Ub144 #U5c0d#U5357#Ubd84#Uc57c #Ube44#Uad50.hwp","sha256":"29430240cb59a12fcde8e4153c0859c90d5a928503a1ca05433f08a7b3c50bf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]}],"files_written":[{"path":"%TEMP%\\5170101-2016년 및 2017년 對南분야 비교.hwp","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%WINDIR%\\System32\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"path":"%WINDIR%\\system32\\en\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%WINDIR%\\System32\\en-US\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"path":"%WINDIR%\\System32\\en-US\\wshext.dll.mui","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_en-us_020378a8991bbcc2\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"},{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5acbfa937ca3e12c8e700563"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%WINDIR%\\SysWOW64\\en\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshext.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%WINDIR%\\SysWOW64\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bdf38817ca3e178871fa82c"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5bdf38817ca3e178871fa82c","5acbfa937ca3e12c8e700563"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious TROJ_EVNYCA.A Sample 95192de1f323… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 95192de1f323…. Malware family: TROJ_EVNYCA.A. Threat score 100/100. 20/27 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a"}],["$","meta","4",{"property":"og:title","content":"Malicious TROJ_EVNYCA.A Sample 95192de1f323… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 95192de1f323…. Malware family: TROJ_EVNYCA.A. Threat score 100/100. 20/27 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/95192de1f3239d5c0a7075627cf9845c91fd397796383185f61dde893989c08a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TROJ_EVNYCA.A Sample 95192de1f323… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 95192de1f323…. Malware family: TROJ_EVNYCA.A. Threat score 100/100. 20/27 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]