21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T496,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Zudochka Sample 0b427461287b… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 0b427461287b…. Malware family: Trojan.Zudochka. Threat score 85/100. 20/28 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af","keywords":["Malicious","Trojan.Zudochka","malware analysis","sandbox report","threat intelligence","0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af"],"about":{"@type":"SoftwareApplication","name":"destructy-1.0.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Trojan.Zudochka","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T224c,Heuristic match: "'unchecked' unwrap on None in BTreeMapsrc\liballoc\collections\btree\map.rs" Heuristic match: "attempt to create unaligned or null slicesrc\libcore\slice\mod.rs" Heuristic match: "attempt to copy from unaligned or null pointersrc\libcore\intrinsics.rs" Heuristic match: "/rustc/4560ea788cb760f0a34127156c78e2552949f734\src\libcore\intrinsics.rs" Heuristic match: "assertion failed: !self.is_shared_root()src\liballoc\collections\btree\node.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\base64-0.11.0\src\encode.rs" Heuristic match: "assertion failed: Layout::from_size_align(size, align).is_ok()src\libcore\alloc.rs" Pattern match: "https://2no.co/3mAp64" Heuristic match: "Desktoppasswordhere.txtajsndhcuyofklqwghftdgcbsmdfkiops.sepsyssepsyssrc\main.rs" Heuristic match: "there is no such thing as a relaxed fencesrc\libcore\sync\atomic.rs" Heuristic match: "assertion failed: index < lensrc\liballoc\vec.rs" Heuristic match: "assertion failed: new_layout.align() == layout.align()src\liballoc\raw_vec.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\walkdir-2.3.1\src\lib.rs" Heuristic match: "/rustc/4560ea788cb760f0a34127156c78e2552949f734\src\libcore\ops\arith.rs" Heuristic match: "/rustc/4560ea788cb760f0a34127156c78e2552949f734\src\liballoc\slice.rs" Heuristic match: "/rustc/4560ea788cb760f0a34127156c78e2552949f734\src\libcore\slice\mod.rs" Heuristic match: "called `Option::unwrap()` on a `None` valuesrc\libcore\option.rs" Heuristic match: "/rustc/4560ea788cb760f0a34127156c78e2552949f734\src\libcore\str\pattern.rs" Pattern match: "http://www.myip.ch" Heuristic match: "assertion failed: is_reading(borrow)src\libcore\cell.rs" Heuristic match: "failed to set error bufferfailed to set header callbackfailed to set write callbackfailed to set read callbackfailed to set seek callbackfailed to set progress callbackfailed to set debug callbackfailed to set open socket callbackC:\Users\tinop\.cargo\regi" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\curl-0.4.25\src\easy\handler.rs" Heuristic match: "formatter errorcalled `Option::unwrap()` on a `None` valuesrc\libcore\option.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\curl-0.4.25\src\lib.rs" Heuristic match: "src\libcore\char\methods.rs" Heuristic match: "there is no such thing as an acquire/release storesrc\libcore\sync\atomic.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\curl-0.4.25\src\error.rs" Heuristic match: "already borrowedalready mutably borrowedassertion failed: is_reading(borrow)src\libcore\cell.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\curl-0.4.25\src\version.rs" Heuristic match: "assertion failed: !ptr.is_null()attempt to copy from unaligned or null pointersrc\libcore\intrinsics.rs" Heuristic match: "assertion failed: new_len <= self.capacity()src\liballoc\vec.rs" Heuristic match: "attempt to write to unaligned or null pointersrc\libcore\intrinsics.rs" Heuristic match: "127.0.0.1:34254attempt to copy from unaligned or null pointersrc\libcore\intrinsics.rs" Heuristic match: "there is no such thing as an acquire/release loadsrc\libcore\sync\atomic.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\aes-soft-0.3.3\src\impls.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\generic-array-0.12.3\src\lib.rs" Heuristic match: "failed to write whole bufferfailed to fill whole buffer/rustc/4560ea788cb760f0a34127156c78e2552949f734\src\libstd\io\impls.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\subtle-2.2.2\src\lib.rs" Heuristic match: "encryption failure!C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\enc_file-0.0.5\src/lib.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\enc_file-0.0.5\src/lib.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\aes-gcm-siv-0.3.0\src\ctr32.rs" Heuristic match: "there is no such thing as a relaxed compiler fencesrc\libcore\sync\atomic.rs" Heuristic match: "Tried to shrink to a larger capacitysrc\liballoc\raw_vec.rs" Heuristic match: "/rustc/4560ea788cb760f0a34127156c78e2552949f734\src\liballoc\raw_vec.rs" Heuristic match: "src\libcore\iter\traits\exact_size.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\aes-soft-0.3.3\src\bitslice.rs" Heuristic match: "Invalid AES key size.C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\aes-soft-0.3.3\src\expand.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\aes-soft-0.3.3\src\expand.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\rand-0.7.3\src\distributions\other.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\byteorder-1.3.4\src\lib.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\bincode-1.2.1\src\de\mod.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\bincode-1.2.1\src\internal.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\aes-gcm-siv-0.3.0\src\lib.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\aead-0.2.0\src\lib.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\rand_core-0.5.1\src\os.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\rand_core-0.5.1\src\impls.rs" Heuristic match: "randSecure: random number generator module is not initializedstdweb: failed to get randomnessstdweb: no randomness source availablewasm-bindgen: crypto.getRandomValues is undefinedwasm-bindgen: self.crypto is undefinedRDRAND: instruction not supportedRDRAN" Heuristic match: "assertion failed: (input == 0u8) | (input == 1u8)C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\subtle-2.2.2\src\lib.rs" Heuristic match: "assertion failed: 4 <= buf.len()attempt to create unaligned or null slicesrc\libcore\slice\mod.rs" Heuristic match: "Errorassertion failed: new_len <= self.capacity()src\liballoc\vec.rs" Heuristic match: "C:\Users\tinop\.cargo\registry\src\github.com-1ecc6299db9ec823\whoami-0.6.0\src\windows.rs" Heuristic match: "assertion failed: self.is_char_boundary(new_len)src\liballoc\string.rs" Heuristic match: "C:\Users\VssAdministrator\.cargo\registry\src\github.com-1ecc6299db9ec823\backtrace-0.3.37\src\backtrace\dbghelp.rs" Heuristic match: "AccessErrorcannot access a TLS value during or after it is destroyeduse of std::thread::current() is not possible after the thread's local data has been destroyedsrc\libstd\thread\mod.rs" Heuristic match: "src\libstd\env.rs" Heuristic match: "..\src\libstd\path.rs" Heuristic match: "src\libstd\sync\condvar.rs" Heuristic match: "src\libstd\sync\once.rs" Heuristic match: "src\libstd\sys_common\at_exit_imp.rs" Heuristic match: "PoisonError { inner: .. }src\libstd\sys_common\thread_info.rs" Heuristic match: "assertion failed: len as usize >= mem::size_of::()invalid port valueinvalid socket address*src\libstd\sys\windows\mutex.rs" Heuristic match: "src\libstd\sys\windows\net.rs" Heuristic match: "src\libstd\sys\windows\os.rs" Heuristic match: "\\?\UNC\src\libstd\sys\windows\path.rs" Heuristic match: "src\libstd\sys\windows\rand.rs" Heuristic match: "src\libstd\sys\windows\thread_local.rs" Heuristic match: "assertion failed: key != c::TLS_OUT_OF_INDEXESstrings passed to WinAPI cannot contain NULsSetThreadStackGuaranteeSleepConditionVariableSRWsrc\libstd\sys\windows\c.rs" Heuristic match: "src\libstd\sys\windows\stdio.rs" Heuristic match: "src\libstd\sys\windows\stack_overflow.rs" Heuristic match: "C:\Users\VssAdministrator\.cargo\registry\src\github.com-1ecc6299db9ec823\rustc-demangle-0.1.16\src\v0.rs" Heuristic match: "/rustc/4560ea788cb760f0a34127156c78e2552949f734\src\libcore\fmt\mod.rs" Heuristic match: "src\libcore\num\flt2dec\strategy\dragon.rs" Heuristic match: "src\libcore\num\flt2dec\strategy\grisu.rs" Heuristic match: "src\libcore\num\flt2dec\mod.rs" Heuristic match: "src\libcore\num\mod.rs" Heuristic match: "src\libcore\result.rs" Heuristic match: "src\libcore\str\pattern.rs" Heuristic match: "src\libcore\fmt\mod.rs" Heuristic match: "src\libcore\unicode\bool_trie.rs" Heuristic match: "kindEmptysrc\libcore\num\bignum.rs" Heuristic match: "src\libcore\num\bignum.rs" Pattern match: "https://curl.haxx.se/docs/http-cookies.html" Heuristic match: "ftp@example.com"23:T8f3,"a Display implementation returned an error unexpectedlyUsersAppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedTaskBarC:\C:\Users\PublicC:\ProgramData\README.html Warning!

ATTENTION! Your computer has been infected by sepSys!

Your files have been encrypted with a random key and no decryption tool can save them

To regain access to your files, please make a $100 donation to Silicon Venom

We only accept payments in Bitcoin (BTC). Check this out to learn more: https://bitcoin.org/en/buy

Your donation should be sent to the following BTC wallet address: 3BL1TbL96gQFTR9EJFKX7JSp889oj2nJmj

Once you have paid, contact us at iaminfected.sac@elude.in to receive yo" (Source: 0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af.bin, Indicator: "files have been encrypted") "a Display implementation returned an error unexpectedlyUsersAppDataRoamingMicrosoftInternet ExplorerQuick LaunchUser PinnedTaskBarC:\C:\Users\PublicC:\ProgramData\README.html Warning!

ATTENTION! Your computer has been infected by sepSys!

Your files have been encrypted with a random key and no decryption tool can save them

To regain access to your files, please make a $100 donation to Silicon Venom

We only accept payments in Bitcoin (BTC). Check this out to learn more: https://bitcoin.org/en/buy

Your donation should be sent to the following BTC wallet address: 3BL1TbL96gQFTR9EJFKX7JSp889oj2nJmj

Once you have paid, contact us at iaminfected.sac@elude.in to receive y" (Source: 0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af.bin, Indicator: "files have been encrypted")24:Ta4b,"destructy-1.0.exe" queries volume information of "C:\Users\Public" at 00060439-00003128-00000046-4631114583 "destructy-1.0.exe" queries volume information of "C:\Users\Public" at 00060439-00003128-00000046-4633292429 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Documents" at 00060439-00003128-00000046-4674662305 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Music" at 00060439-00003128-00000046-4676943933 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Pictures" at 00060439-00003128-00000046-4678633263 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Videos" at 00060439-00003128-00000046-4680373207 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Downloads" at 00060439-00003128-00000046-4683209696 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Favorites" at 00060439-00003128-00000046-4686507761 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Libraries" at 00060439-00003128-00000046-4689686962 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Libraries\RecordedTV.library-ms" at 00060439-00003128-00000046-4691579712 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Music" at 00060439-00003128-00000046-4729859500 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Music\Sample Music" at 00060439-00003128-00000046-4733028715 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg" at 00060439-00003128-00000046-4736156678 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg" at 00060439-00003128-00000046-4841136629 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Music\Sample Music\Kalimba.mp3" at 00060439-00003128-00000046-4879060340 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Desktop" at 00060439-00003128-00000046-8594791409 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Desktop\Acrobat Reader DC.lnk" at 00060439-00003128-00000046-8597458172 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3" at 00060439-00003128-00000046-24214437789 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Music\Sample Music\Sleep Away.mp3" at 00060439-00003128-00000046-34257116138 "destructy-1.0.exe" queries volume information of "C:\Users\Public\Pictures" at 00060439-00003128-00000046-4109056378425:T725,"destructy-1.0.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "destructy-1.0.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "destructy-1.0.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "destructy-1.0.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "destructy-1.0.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "reg.exe" touched file "C:\Windows\System32\en-US\reg.exe.mui" "reg.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "reg.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\en-US\powershell.exe.mui" "powershell.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "powershell.exe" touched file "C:\Users\3ZrkVGU\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" touched file "C:\Windows\System32\en-US\shell32.dll.mui" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu" "powershell.exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" touched file "C:\Users\3ZrkVGU\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations"26:T9b3,"powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xF3118C4B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xF3118C0B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042588150000" to virtual address "0xF311863C" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2588150000" to virtual address "0xF31174FB" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "1893e60200000000" to virtual address "0x73012650" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "654c8b1c2588150000" to virtual address "0xF31177AA" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xF3118CCB" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "78cf117aebeb0000" to virtual address "0xF2EA1D70" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042588150000" to virtual address "0xF3117A60" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042588150000" to virtual address "0xF3117A25" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042588150000" to virtual address "0xF3117A44" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2588150000" to virtual address "0xF311743F" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xF3118C8B" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2588150000" to virtual address "0xF31178AD" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "4893e60200000000" to virtual address "0x73012658" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "eb11c366669066669066669066669066669090" to virtual address "0xF3115BC0" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2588150000" to virtual address "0xF3117403" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "4889114881fa1810ec02722448c1e90a80b94045eb1aff7502f3c3c6814045eb1affc366666690666666906666906690f3c3ff7502f3c3c60408ffc366666690f3c3666666906666669066669066669090" to virtual address "0xF3115F00" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "b892e60200000000" to virtual address "0x73012640" (part of module "SYSTEM.DATA.DLL") "powershell.exe" wrote bytes "669065488b042588150000c366669066669090" to virtual address "0xF3115B40" (part of module "MSCORWKS.DLL")27:T848,"C:\destructy-1.0.exe" marked "C:\Users\Public\Desktop\Acrobat Reader DC.lnk" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Libraries\RecordedTV.library-ms" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Music\Sample Music\Kalimba.mp3" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Music\Sample Music\Sleep Away.mp3" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Pictures\Sample Pictures\Desert.jpg" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Pictures\Sample Pictures\Koala.jpg" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" for deletion "C:\destructy-1.0.exe" marked "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv" for deletion "C:\destructy-1.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt18.lst" for deletion "C:\destructy-1.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt18.lst" for deletion "C:\destructy-1.0.exe" marked "C:\Users\%OSUSER%\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt18.lst" for deletion28:T884,"destructy-1.0.exe" opened "C:\Users\Public\Desktop\Acrobat Reader DC.lnk" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Libraries\RecordedTV.library-ms" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Music\Sample Music\Kalimba.mp3" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Music\Sample Music\Sleep Away.mp3" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Desert.jpg" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Koala.jpg" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "destructy-1.0.exe" opened "C:\Users\Public\Videos\Sample Videos\Wildlife.wmv" with delete access "destructy-1.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt18.lst" with delete access "destructy-1.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt18.lst" with delete access "destructy-1.0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt18.lst" with delete access29:T5f1,"destructy-1.0.exe" wrote 32 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 136) "destructy-1.0.exe" wrote 52 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 136) "destructy-1.0.exe" wrote 8 bytes to a remote process "C:\Windows\System32\reg.exe" (Handle: 136) "destructy-1.0.exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 140) "destructy-1.0.exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 140) "destructy-1.0.exe" wrote 8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 140) "powershell.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 1192) "powershell.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 1192) "powershell.exe" wrote 8 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 1192) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 892) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 892) "iexplore.exe" wrote 8 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 892) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 892)2a:T6ae,Found malicious artifacts related to "88.99.66.31": ... URL: https://iplogger.org/2ubsh5 (AV positives: 3/73 scanned on 02/25/2020 14:03:56) URL: http://iplogger.org/1HVwe7.png (AV positives: 7/73 scanned on 02/25/2020 12:09:07) URL: https://iplogger.org/1H7Yt7. (AV positives: 3/73 scanned on 02/25/2020 11:57:01) URL: https://iplogger.org/listfull/d6bzr1KkW37 (AV positives: 3/73 scanned on 02/25/2020 11:47:03) URL: https://iplogger.org/logger/85d3n41KAQ37/ (AV positives: 3/73 scanned on 02/25/2020 11:16:34) File SHA256: dd11ff89a3072584f36171a4f407086683bc0b6c7406165cb6f67230a4d48a93 (Date: 02/25/2020 13:35:34) File SHA256: e5acf9c033d58121a8a657826f1150d7d434e75db2502ec0c9ff5e439c82ad78 (Date: 02/25/2020 13:21:37) File SHA256: ac793504f4eb582f258e04810274bcb9df7f9c08ab5aad5759030a1def3373e0 (Date: 02/25/2020 13:13:51) File SHA256: edbd0bf0bd4d86b551878753f16a1d5a2f37537a568d6e08e4a4ef9c935e1142 (Date: 02/25/2020 13:09:44) File SHA256: 70c05ba447c1871051a791eefae32c9b1a0bd42848a767cad0af0dae446b51ae (Date: 02/25/2020 13:04:03) File SHA256: b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599 (AV positives: 1/71 scanned on 02/21/2020 19:22:36) File SHA256: 636a31559c9a532a8ada119380129f9362f6c68b3456228766b3672ae3d676d8 (AV positives: 6/72 scanned on 02/04/2020 18:20:37) File SHA256: 39fedb6662bb5d420b85dedbc651dcf5d7b44d5199dfc447fed791ca46033d59 (AV positives: 35/71 scanned on 01/23/2020 13:08:17) File SHA256: 47477321fe6b5919fc5cb77ed4256dee0f796a64927cf3b8509460130d9c8e41 (AV positives: 1/72 scanned on 01/23/2020 20:02:34) File SHA256: fb946c4a8cc52fe4137ec3747455f84f64f7ef4660c9b7cf30aefb61e24b2827 (AV positives: 23/72 scanned on 01/17/2020 07:34:15)2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790674681246,"unified_at":"2026-09-29T09:38:01.246Z","metadata":{"hashes":{"sha256":"0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af","sha1":"bd5cf6f63649b9c3cc485eaafb5733a8685c9ffe","md5":"fd2e7cca16052f57eb50aecc650345e2","sha512":"d772b4a31607a84b97e170e0147be5fb6351ebdaf02b789db80ca1bd509bf07a9b70dd7b66102cff85fbb136228cbb5242dd38aa78ae22ee2d662e072f9fad3a","ssdeep":"24576:B4Ug2+Dtpin8PTt2hp5yrouYRzHBV5QlGSAjGIqdX2xZea9Z2PiJHThykS:p+Dti8PTt2hosjB3Ii6IHT","ssdeep_chunks":["24576:B4Ug2+D","24576:4Ug2+Dt","24576:Ug2+Dtp","24576:g2+Dtpi","24576:2+Dtpin","24576:+Dtpin8","24576:Dtpin8P","24576:tpin8PT","24576:pin8PTt","24576:in8PTt2","24576:n8PTt2h","24576:8PTt2hp","24576:PTt2hp5","24576:Tt2hp5y","24576:t2hp5yr","24576:2hp5yro","24576:hp5yrou","24576:p5yrouY","24576:5yrouYR","24576:yrouYRz","24576:rouYRzH","24576:ouYRzHB","24576:uYRzHBV","24576:YRzHBV5","24576:RzHBV5Q","24576:zHBV5Ql","24576:HBV5QlG","24576:BV5QlGS","24576:V5QlGSA","24576:5QlGSAj","24576:QlGSAjG","24576:lGSAjGI","24576:GSAjGIq","24576:SAjGIqd","24576:AjGIqdX","24576:jGIqdX2","24576:GIqdX2x","24576:IqdX2xZ","24576:qdX2xZe","24576:dX2xZea","24576:X2xZea9","24576:2xZea9Z","24576:xZea9Z2","24576:Zea9Z2P","24576:ea9Z2Pi","24576:a9Z2PiJ","24576:9Z2PiJH","24576:Z2PiJHT","24576:2PiJHTh","24576:PiJHThy","24576:iJHThyk","24576:JHThykS","49152:B4Ug2+D","49152:4Ug2+Dt","49152:Ug2+Dtp","49152:g2+Dtpi","49152:2+Dtpin","49152:+Dtpin8","49152:Dtpin8P","49152:tpin8PT","49152:pin8PTt","49152:in8PTt2","49152:n8PTt2h","49152:8PTt2hp","49152:PTt2hp5","49152:Tt2hp5y","49152:t2hp5yr","49152:2hp5yro","49152:hp5yrou","49152:p5yrouY","49152:5yrouYR","49152:yrouYRz","49152:rouYRzH","49152:ouYRzHB","49152:uYRzHBV","49152:YRzHBV5","49152:RzHBV5Q","49152:zHBV5Ql","49152:HBV5QlG","49152:BV5QlGS","49152:V5QlGSA","49152:5QlGSAj","49152:QlGSAjG","49152:lGSAjGI","49152:GSAjGIq","49152:SAjGIqd","49152:AjGIqdX","49152:jGIqdX2","49152:GIqdX2x","49152:IqdX2xZ","49152:qdX2xZe","49152:dX2xZea","49152:X2xZea9","49152:2xZea9Z","49152:xZea9Z2","49152:Zea9Z2P","49152:ea9Z2Pi","49152:a9Z2PiJ","49152:9Z2PiJH","49152:Z2PiJHT","49152:2PiJHTh","49152:PiJHThy","49152:iJHThyk","49152:JHThykS","24576:p+Dti8P","24576:+Dti8PT","24576:Dti8PTt","24576:ti8PTt2","24576:i8PTt2h","24576:8PTt2ho","24576:PTt2hos","24576:Tt2hosj","24576:t2hosjB","24576:2hosjB3","24576:hosjB3I","24576:osjB3Ii","24576:sjB3Ii6","24576:jB3Ii6I","24576:B3Ii6IH","24576:3Ii6IHT"],"imphash":"05fa8ca9cb229f3d67969b93c5624c35"},"file_info":{"file_name":"destructy-1.0.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1774592,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1582642139000,"last_seen":1677890968000,"last_multi_scan":1677890968000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["ransomware","SepSys","banker","cenjonsla","coinminer","miner","opensupdater","ramnit","softcnapp","tiggre"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":25,"suspicious_count":20,"malicious_count":5,"total":50},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.Filecoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Zudochka","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Ransom.SepSys.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.42682853","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W64/Zudochka.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.SepSys (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win64/Filecoder.BM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/SepSys.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zudochka.ebg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Zudochka.heassc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FVG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W64.Zudochka.1774592","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.A0D49278","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.A0D49278","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ransom.CAK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Zudochka","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Zudochka.Win32.346","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Zudochka","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"informative","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 34938-272-0000000140154504\n SetUnhandledExceptionFilter@KERNEL32.dll at 34938-10505-0000000140154B44\n SetUnhandledExceptionFilter@KERNEL32.dll at 34938-11796-0000000140154CF0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 34938-1088-00000001401540F5\n GetProcessHeap@KERNEL32.dll at 34938-1096-000000014000FE40\n GetProcessHeap@KERNEL32.dll at 34938-1095-000000014000FE20\n GetProcessHeap@KERNEL32.dll at 34938-1087-00000001400C5510","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/69 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Documents\\Experiments\\virusTests\\sepSys1-0\\target\\debug\\deps\\sepSys1_0-ebd9526c88434a09.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.dll at 34938-8978-0000000140154155","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.dll at 34938-1563-00000001400BCE70","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$22","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/72 reputation engines marked \"https://bitcoin.org/en/buy\" as malicious (1% detection rate)\n 1/72 reputation engines marked \"https://bitcoin.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"ftp@example.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"d2i_X509X509_freeX509_STORE_add_certSSL_CTX_get_cert_storeOpenSSL/1.1.0libcryptolibsslOpenSSL/1.0.2libeay32ssleay32ROOT1.3.6.1.5.5.7.3.1\"\n \"127.0.0.1:34254attempt to copy from unaligned or null pointersrc\\libcore\\intrinsics.rs\"\n \"2.5.29.17\"\n Heuristic match: \"127.0.0.1/\"\n Heuristic match: \"1.3.14.3.2.26\"\n \"2.5.29.18\"\n \"2.5.29.19\"\n Heuristic match: \"2.16.840.1.101.3.4.2.4\"\n Heuristic match: \"2.16.840.1.101.3.4.2.1\"\n Heuristic match: \"2.16.840.1.101.3.4.2.2\"\n Heuristic match: \"2.16.840.1.101.3.4.2.3\"\n \"2.5.4.3\"\n \"1.2.0.4\"\n \"2.5.4.4\"\n \"2.5.4.5\"\n \"2.5.4.6\"\n \"2.5.4.7\"\n \"2.5.4.8\"\n \"2.5.4.9\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.12\"\n \"2.5.4.13\"\n \"2.5.4.17\"\n \"2.5.4.41\"\n \"2.5.4.42\"\n \"2.5.4.43\"\n \"2.5.4.44\"\n \"2.5.4.45\"\n \"2.5.4.46\"\n \"2.5.4.65\"\n \"2.5.4.72\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$23","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af.bin\" has a TLS callback with entrypoint at 0x400dce30\n \"0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af.bin\" has a TLS callback with entrypoint at 0x1","origin":"Static Parser","mitre_attack_id":"T1055","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetUserNameW\n DeviceIoControl\n LoadLibraryA\n IsDebuggerPresent\n GetTickCount\n GetModuleHandleW\n UnhandledExceptionFilter\n DeleteFileW\n GetProcAddress\n GetModuleHandleA\n GetFileSizeEx\n FindNextFileW\n FindFirstFileW\n TerminateProcess\n WriteFile\n CreateFileW\n SleepEx\n CreateProcessW\n Sleep\n CreateFileA\n accept\n WSAStartup\n WSASocketW\n closesocket\n send\n listen\n recv\n socket\n bind\n connect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af.bin\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 34938-1274-0000000140154137","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5e5533d951a38934f71f35a5"},{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$24","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.myip.ch\"\n \"isrg.trustid.ocsp.identrust.com\"\n \"ocsp.int-x3.letsencrypt.org\"\n \"swisssign.net\"\n \"gold-ev-g2.ocsp.swisssign.net\"\n \"2no.co\"\n \"protonmail.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"62.2.148.4:80\"\n \"88.99.66.31:443\"\n \"23.35.70.136:80\"\n \"23.35.70.185:80\"\n \"185.70.41.35:443\"\n \"91.194.146.115:80\"\n \"8.249.171.254:80\"\n \"91.194.146.110:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"iexplore.exe\" created file \"%TEMP%\\~DF3140D3B043FF5BF8.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DFB29DB3B328232759.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DFF7D5E28004F9AA6A.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\JavaDeployReg.log\"\n \"iexplore.exe\" created file \"%TEMP%\\Cab9A19.tmp\"\n \"iexplore.exe\" created file \"%TEMP%\\Tar9A1A.tmp\"\n \"iexplore.exe\" created file \"%TEMP%\\Cab9A3A.tmp\"\n \"iexplore.exe\" created file \"%TEMP%\\Tar9A3B.tmp\"\n \"iexplore.exe\" created file \"%TEMP%\\JavaDeployReg.log\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df4_IESQMMUTEX_0_519\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"IsoScope_df4_IESQMMUTEX_0_331\"\n \"IsoScope_df4_IESQMMUTEX_0_303\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"UpdatingNewTabPageData\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"IsoScope_df4_ConnHashTable<3572>_HashTable_Mutex\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"IsoScope_df4_IE_EarlyTabStart_0xe08_Mutex\"\n \"IsoScope_df4_IESQMMUTEX_0_519\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3572\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nHost: www.myip.ch\nAccept: */*\"\n \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: isrg.trustid.ocsp.identrust.com\"\n \"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgPAlKDFmOROcYdKkShFZ3AtUQ%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.int-x3.letsencrypt.org\"\n \"GET /cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: swisssign.net\"\n \"GET /5B257B96A465517EB839F3C078665EE83AE7F0EE/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRWLiSVGpdkcjxkcyWacgNWnI4uogQUWyV7lqRlUX64OfPAeGZe6Drn8O4CEACBCDg8wAd1xAxtc2vjMIs%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: gold-ev-g2.ocsp.swisssign.net\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00060748-00003572)\n Launches browser \"iexplore.exe\" (UID: 00060804-00002228)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at EBA60000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"reg.exe\" (UID: 00060576-00001688) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"reg.exe\" (UID: 00060576-00001688) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"iexplore.exe\" (UID: 00060748-00003572) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"\n Process \"iexplore.exe\" (UID: 00060748-00003572) was launched with modified environment variables: \"PSModulePath\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"reg.exe\" with commandline \"\"reg\" ADD HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ...\" (UID: 00060576-00001688)\n Spawned process \"powershell.exe\" with commandline \"\"powershell\" -WindowStyle hidden -Command Start-Process -FilePat ...\" (UID: 00060578-00002256)\n Spawned process \"iexplore.exe\" with commandline \"%ALLUSERSPROFILE%\\README.html\" (UID: 00060748-00003572)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3572 CREDAT:275457 /prefetch:2\" (UID: 00060804-00002228)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"reg.exe\" with commandline \"\"reg\" ADD HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v ...\" (UID: 00060576-00001688)\n Spawned process \"powershell.exe\" with commandline \"\"powershell\" -WindowStyle hidden -Command Start-Process -FilePat ...\" (UID: 00060578-00002256)\n Spawned process \"iexplore.exe\" with commandline \"%ALLUSERSPROFILE%\\README.html\" (UID: 00060748-00003572)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3572 CREDAT:275457 /prefetch:2\" (UID: 00060804-00002228)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"urlblockindex_1_.bin\" has type \"data\"\n \"www.youtube_1_.xml.sepsys\" has type \"data\"\n \"44WXH2PQ.htm.sepsys\" has type \"data\"\n \"om.elvenar_1_.xml.sepsys\" has type \"data\"\n \"personal.natwest_1_.xml.sepsys\" has type \"data\"\n \"www.espncricinfo_1_.xml.sepsys\" has type \"data\"\n \"www.amazon_1_.xml.sepsys\" has type \"data\"\n \"es.ign_1_.xml.sepsys\" has type \"DOS executable (COM)\"\n \"www.suning_1_.xml.sepsys\" has type \"data\"\n \"widget.weibo_1_.xml.sepsys\" has type \"data\"\n \"01_Music_auto_rated_at_5_stars.wpl.sepsys\" has type \"data\"\n \"www.caixa.gov_1_.xml.sepsys\" has type \"data\"\n \"_4C6D0F0C-D9F0-11E7-8220-080027D44A30_.dat.sepsys\" has type \"data\"\n \"www.nickelodeon_1_.xml.sepsys\" has type \"data\"\n \"5C05A7F80FDB637CF0C02C59027355B3\" has type \"data\"\n \"www.irs_1_.xml.sepsys\" has type \"data\"\n \"www.victoriassecret_1_.xml.sepsys\" has type \"data\"\n \"BannerAPFMilhoTB_1_.jpg.sepsys\" has type \"data\"\n \"www.gry_1_.xml.sepsys\" has type \"Applesoft BASIC program data first line number 2\"\n \"adobe-head_1_.js.sepsys\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SERVICE\"; Value: \"%ALLUSERSPROFILE%\\README.html\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"destructy-1.0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"destructy-1.0.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$26","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"destructy-1.0.exe\" is allocating memory with PAGE_GUARD access rights\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"destructy-1.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ETPRO POLICY External IP Address Lookup - myip.ch\" (SID: 2823420, Rev: 2, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ETPRO POLICY Possible External IP Lookup SSL Cert Observed (iplogger .com)\" (SID: 2832295, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"es.ign_1_.xml.sepsys\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 62.2.148.4 on port 80 is sent without HTTP header\n TCP traffic to 88.99.66.31 on port 443 is sent without HTTP header\n TCP traffic to 23.35.70.136 on port 80 is sent without HTTP header\n TCP traffic to 23.35.70.185 on port 80 is sent without HTTP header\n TCP traffic to 185.70.41.35 on port 443 is sent without HTTP header\n TCP traffic to 91.194.146.115 on port 80 is sent without HTTP header\n TCP traffic to 8.249.171.254 on port 80 is sent without HTTP header\n TCP traffic to 91.194.146.110 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"README.html\" which has been seen in the context of ransomware (Indicator: README.html)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1284 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$27","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$28","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contacts Mail Related Domain Names","description":"\"protonmail.com\" is probably a mail server","origin":"Network Traffic","relevance":10,"id":"network-18","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"Cab9A19.tmp\" has type \"Microsoft Cabinet archive data 56802 bytes 1 file\"\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data 56802 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"LoadLibraryExA\" (Source: 0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af.bin, API is part of module: KERNELBASE.DLL)\n Found string \"AddDllDirectory\" (Source: 0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af.bin, API is part of module: KERNELBASE.DLL)\n Found string \"InitSecurityInterfaceA\" (Source: 0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af.bin, API is part of module: SSPICLI.DLL)\n Found string \"EncryptMessage\" (Source: 0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af.bin, API is part of module: SSPICLI.DLL)\n Found string \"DecryptMessage\" (Source: 0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af.bin, API is part of module: SSPICLI.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Opens many files with write access (often indicator for full-system infection)","description":"\"iexplore.exe\" opens more than 500 files with write access","origin":"API Call","relevance":10,"id":"api-49","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"destructy-1.0.exe\" allocated memory in \"%USERPROFILE%\\AppData\"\n \"destructy-1.0.exe\" allocated memory in \"%USERPROFILE%\\Device\\Ide\\IdeDeviceP1T0L0-1\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$29","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a Wine emulator related string"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 7 domains and 7 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":38,"imported_dlls_count":174,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":607,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":14,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":16,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":7,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["ransomware","SepSys","banker","cenjonsla","coinminer","miner","opensupdater","ramnit","softcnapp","tiggre"],"sample_flags":["Launch Failed","User Comment","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5e5533f952de180025788409","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["CHE","DEU","USA"],"submit_name":"destructy-1.0.exe","analysis_start_time":"2020-02-25T14:49:42+00:00","indicators_count":{"informative":25,"suspicious":24,"malicious":5},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5e5533d951a38934f71f35a5","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"undetected","threat_score":37,"submit_name":"destructy-1.0.exe","analysis_start_time":"2020-02-25T14:49:07+00:00","indicators_count":{"informative":7,"suspicious":6,"malicious":2},"tags":["Launch Failed","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"62.2.148.4","port":80,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"address":"88.99.66.31","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"address":"23.35.70.136","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"address":"23.35.70.185","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"address":"185.70.41.35","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"address":"91.194.146.115","port":80,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"address":"8.249.171.254","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"address":"91.194.146.110","port":80,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}],"dns_resolutions":[{"domain":"2no.co","address":"88.99.66.31","ttl":3599,"country":"Germany","registrar_name":"GODADDY.COM, INC.","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS3.FASTVPS.RU","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"domain":"gold-ev-g2.ocsp.swisssign.net","address":"91.194.146.110","ttl":3016,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"domain":"isrg.trustid.ocsp.identrust.com","address":"23.35.70.136","ttl":22,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"domain":"ocsp.int-x3.letsencrypt.org","address":"23.35.70.185","ttl":6036,"country":"United States","registrar_name":"eNom, Inc.","registrar_organization":"Internet Security Research Group","registrar_name_servers":"A9-67.AKAM.NET","registrar_creation_date":"2014-07-07T19:54:04+00:00","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"domain":"protonmail.com","address":"185.70.41.35","ttl":1057,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"domain":"swisssign.net","address":"91.194.146.115","ttl":3065,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"domain":"www.myip.ch","address":"62.2.148.4","ttl":3599,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}],"http_requests":[{"host":"www.myip.ch","host_ip":"62.2.148.4:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nHost: www.myip.ch\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"host":"isrg.trustid.ocsp.identrust.com","host_ip":"23.35.70.136:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: isrg.trustid.ocsp.identrust.com","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"host":"ocsp.int-x3.letsencrypt.org","host_ip":"23.35.70.185:80","url":"/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgPAlKDFmOROcYdKkShFZ3AtUQ%3D%3D","method":"GET","header":"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgPAlKDFmOROcYdKkShFZ3AtUQ%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.int-x3.letsencrypt.org","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"host":"swisssign.net","host_ip":"91.194.146.115:80","url":"/cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE","method":"GET","header":"GET /cgi-bin/authority/download/5B257B96A465517EB839F3C078665EE83AE7F0EE HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: swisssign.net","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"host":"gold-ev-g2.ocsp.swisssign.net","host_ip":"91.194.146.110:80","url":"/5B257B96A465517EB839F3C078665EE83AE7F0EE/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRWLiSVGpdkcjxkcyWacgNWnI4uogQUWyV7lqRlUX64OfPAeGZe6Drn8O4CEACBCDg8wAd1xAxtc2vjMIs%3D","method":"GET","header":"GET /5B257B96A465517EB839F3C078665EE83AE7F0EE/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRWLiSVGpdkcjxkcyWacgNWnI4uogQUWyV7lqRlUX64OfPAeGZe6Drn8O4CEACBCDg8wAd1xAxtc2vjMIs%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: gold-ev-g2.ocsp.swisssign.net","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}],"processes":[{"pid":3128,"ppid":0,"name":"destructy-1.0.exe","command_line":"","sha256":"0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af","normalized_path":"C:\\destructy-1.0.exe","uid":"00060439-00003128","icon":"$2b"},{"pid":1688,"ppid":3128,"name":"reg.exe","command_line":"\"reg\" ADD HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Service /t REG_SZ /d %ALLUSERSPROFILE%\\README.html","sha256":"4e66b857b7010db8d4e4e28d73eb81a99bd6915350bb9a63cd86671051b22f0e","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00060439-00003128","uid":"00060576-00001688"},{"pid":2256,"ppid":3128,"name":"powershell.exe","command_line":"\"powershell\" -WindowStyle hidden -Command Start-Process -FilePath %ALLUSERSPROFILE%\\README.html","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00060439-00003128","uid":"00060578-00002256"},{"pid":3572,"ppid":2256,"name":"iexplore.exe","command_line":"%ALLUSERSPROFILE%\\README.html","sha256":"c00b9f2b32828341a9185ae2be1a0649c9f503f0b5cccebc75be4c2f8c596530","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00060578-00002256","uid":"00060748-00003572"},{"pid":2228,"ppid":3572,"name":"iexplore.exe","command_line":"SCODEF:3572 CREDAT:275457 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00060748-00003572","uid":"00060804-00002228"}],"all_imported_dlls":["mshtml.dll","msimtf.dll","api-ms-win-crt-stdio-l1-1-0.dll","System.Management.ni.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","ieui.dll","dhcpcsvc6.dll","SensApi.dll","ssv.dll","cabinet.dll","System.Management.Automation.ni.dll","System.Core.ni.dll","msvcr100.dll","mlang.dll","winhttp.dll","System.Data.ni.dll","advapi32.dll","dnsapi.dll","cscapi.dll","mscoreei.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","tzres.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","WindowsCodecs.dll","schannel.dll","msctf.dll","ncrypt.dll","gpapi.dll","d3d11.dll","mscorjit.dll","secur32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","uxtheme.dll","System.Xml.ni.dll","npmproxy.dll","wintrust.dll","ucrtbase.dll","ntshrui.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","bcryptprimitives.dll","devrtl.dll","rasadhlp.dll","api-ms-win-crt-filesystem-l1-1-0.dll","System.ni.dll","System.Data.dll","dui70.dll","jscript9.dll","ws2_32.dll","devobj.dll","mscoree.dll","Wldap32.dll","sxs.dll","crypt32.dll","mswsock.dll","imm32.dll","apphelp.dll","userenv.dll","linkinfo.dll","api-ms-win-downlevel-user32-l1-1-0.dll","urlmon.dll","KernelBase.dll","cryptbase.dll","setupapi.dll","ole32.dll","cryptsp.dll","ieproxy.dll","Microsoft.PowerShell.Security.ni.dll","oleaccrc.dll","wship6.dll","psapi.dll","nlaapi.dll","d3d10warp.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","wininet.dll","dhcpcsvc.dll","cryptnet.dll","comctl32.dll","url.dll","wow64cpu.dll","user32.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","sqmapi.dll","msimg32.dll","vcruntime140.dll","FWPUCLNT.DLL","comdlg32.dll","api-ms-win-crt-math-l1-1-0.dll","shlwapi.dll","System.Transactions.dll","netapi32.dll","credssp.dll","atl.dll","oleaut32.dll","clbcatq.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","netutils.dll","ieframe.dll","duser.dll","rpcrt4.dll","nsi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wshqos.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","srvcli.dll","System.Configuration.Install.ni.dll","System.Transactions.ni.dll","dxgi.dll","MSOHEV.DLL","imagehlp.dll","msvcrt.dll","api-ms-win-crt-utility-l1-1-0.dll","normaliz.dll","msvcr80.dll","d2d1.dll","deploy.dll","kernel32.dll","slc.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wow64win.dll","DWrite.dll","WSHTCPIP.DLL","api-ms-win-core-file-l1-2-0.dll","cfgmgr32.dll","mscorrc.dll","IEShims.dll","wkscli.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","System.DirectoryServices.ni.dll","dwmapi.dll","msasn1.dll","gdi32.dll","sechost.dll","lpk.dll","rpcss.dll","shell32.dll","ExplorerFrame.dll","bcrypt.dll","RpcRtRemote.dll","URLREDIR.DLL","propsys.dll","iertutil.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","webio.dll","wow64.dll","ntdll.dll","winnsi.dll","ntmarta.dll","mscorwks.dll","Microsoft.PowerShell.Commands.Management.ni.dll","netprofm.dll","msvcr90.dll","shfolder.dll","oleacc.dll","IPHLPAPI.DLL","shdocvw.dll","mscorlib.ni.dll","VxSSL64.dll","jp2ssv.dll","sspicli.dll","api-ms-win-core-file-l2-1-0.dll","profapi.dll","rsaenh.dll","version.dll","Microsoft.WSMan.Management.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"README.html","sha256":"04b2c9c9dd256482d638cff9e303ef7448e15771f7929eeb86e1283ba7c0fc2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"AOT6807Z.txt","sha256":"154008d497b5ba00ed5997453bd4c886f431db851aed3d4edd0106f08ffa2346","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"T6EEU22P.txt","sha256":"45fcf281b60ef613197dde07745f31b4963128860139419b7cb03f3fcaea74f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"ULHQVXIPTMBQCJKWTP38.temp","sha256":"8175343cd78d246a36f33c5eb40d97ef8e9bd8c4d9e7f219551afc197ac8ce72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"data_0.sepsys","sha256":"1c0debf622e4a29068e94ba915874b91470b5b22dc8d46ea752cbc3d32d46230","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"data_1.sepsys","sha256":"63075594627e60698319bd8a4d5684ca66e715ac80d589e8b958adfe1dbeaaa0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"data_2.sepsys","sha256":"d06262ad36f7bd265038713b7c2b149d0a091206f15a4d163e6691ab99e72ad7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"data_3.sepsys","sha256":"4286426e0315a6942c7d7a05db94f45ab40888aceac238e03529022c60a490a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"index.sepsys","sha256":"ac5ff1e13bad290147742985dc9acedb46d3da47e1dac5cc13b7fd580fd603b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Visited Links.sepsys","sha256":"9fa008ee500b908ae233e85892b81d7b9864640beb03fadced770a3f4640ded9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Cookies-journal.sepsys","sha256":"3e41c340c7bd073bc09ebf9f1b017840bc81ee706f7a92fdafe50666d1510298","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Cookies.sepsys","sha256":"c0fb094b8fb3704ecf66ccb6a3095e19ea36c93f442a8df988c8f2a79eea27a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"AdobeCMapFnt18.lst.sepsys","sha256":"cd3f258bbe5e8fa99f5d9c59779d6e97d7b5b02c6675f353559db172682a4c6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"AdobeSysFnt18.lst.sepsys","sha256":"8d24216e8d0beeda60e10dd371db0dbbce71bfe8818f0a101ba4d7da4ff234bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"AcroFnt18.lst.sepsys","sha256":"a5485bb8c438f4997bcbbd7a4ce37afd44bc4769421a99f8da048fc46e38f43c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"IconCacheRdr65536.dat.sepsys","sha256":"7aeac4ef3d7f919418fef12ba2725b914d6e6272adcebb378081aa5b9e250f52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"SharedDataEvents.sepsys","sha256":"0661500fe371bd759573907f6ed48d07e526921a4ed80fc88cc2a5b5d28a6ddd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"ACECache11.lst.sepsys","sha256":"891bcdbd4858c8f13ddf34b141af8e1a011807bcd8a9ec6e1086c7c7a20449aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"wsRGB.icc.sepsys","sha256":"254a990688470d90f707cc28337aa0053f6cf17ca98136af381078ef3a23b13a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"wscRGB.icc.sepsys","sha256":"a97f646b46081f31afe88dd4920e23e0d9458f6f81e465a2900b5a08e4a9d0f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\cache.sys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Desktop\\Acrobat Reader DC.lnk.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Documents","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Music","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Pictures","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Videos","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Downloads","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Libraries","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Libraries\\RecordedTV.library-ms.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Music\\Sample Music","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Desktop","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\hh.exe","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\ULHQVXIPTMBQCJKWTP38.temp","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\index351.dat","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\assembly\\pubpol201.dat","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%TEMP%\\~DF3140D3B043FF5BF8.TMP","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\getevent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{4130D71F-57DE-11EA-8A4B-3C00274D73A0}.dat","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%TEMP%\\~DFB29DB3B328232759.TMP","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Fonts\\courbd.ttf","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%ALLUSERSPROFILE%\\README.html","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\js9ur7b\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\url.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B2A086B549E10905E818876E77D6B349","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_C95AFE779A09B6B8C03D47AD8998ACC3","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\644B8874112055B5E195ECB0E8F243A4","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2A086B549E10905E818876E77D6B349","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\955009A7E54B8B34C1F2F749A0C5D5A2","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\catroot2\\dberr.txt","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{4130D71D-57DE-11EA-8A4B-3C00274D73A0}.dat","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[5].ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YRECD7ZI.txt","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5C05A7F80FDB637CF0C02C59027355B3","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Kalimba.mp3.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%TEMP%\\Cab9A19.tmp","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%TEMP%\\Tar9A1A.tmp","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[4].ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[5].ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon4J4HYWBP.png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5C05A7F80FDB637CF0C02C59027355B3","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_A7A8E86FCB076C144BD04C40841E7074","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6CY2NG59.txt","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\24I82KXY.txt","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8F36C1630AAD86166941FBDC168F9C4C_E9C431DE38E7D343D77E5721F449C396","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%TEMP%\\Cab9A3A.tmp","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%TEMP%\\Tar9A3B.tmp","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8F36C1630AAD86166941FBDC168F9C4C_E9C431DE38E7D343D77E5721F449C396","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8F36C1630AAD86166941FBDC168F9C4C_EEB054480DEED098661E0E9E34DEEC3C","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6A63C8D61ABC5BE834CB445411E7C641","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57865E02D5B35B8E00909CB5A45612C3","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[9].png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[10].png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\faviconSS6VEUU1.png","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[4].ico","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Sleep Away.mp3.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Desert.jpg.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Hydrangeas.jpg.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Jellyfish.jpg.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Koala.jpg.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Lighthouse.jpg.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Penguins.jpg.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Tulips.jpg.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Recorded TV","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\Wildlife.wmv.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeCMapFnt18.lst.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeSysFnt18.lst.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\Cache","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt18.lst.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\SharedDataEvents.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\UserCache.bin.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies-journal.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AIR","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AIR\\logs","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Color","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Color\\ACECache11.lst.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Color\\Profiles","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Color\\Profiles\\wscRGB.icc.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Color\\Profiles\\wsRGB.icc.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\CEF","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\CEF\\User Data","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\CEF\\User Data\\Dictionaries","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\ElevatedDiagnostics","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Google","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\twitter[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\IconCache.db.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Credentials","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\Feeds for United States~","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\Feeds for United States~\\Popular Government Questions from USA~dgov~.feed-ms.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\Feeds for United States~\\USA~dgov Updates~c News and Features~.feed-ms.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\Microsoft Feeds~","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds Cache","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\FORMS","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\FORMS\\FRMDATA64.DAT.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.3.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\3797665.fls.doubleclick[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\5053232.fls.doubleclick[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\61939614.lo.cobrowse.liveperson[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\61[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\9223[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\a2129670914.cdn.optimizely[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\a2174.casalemedia[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\a2627010012.cdn.optimizely[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\a3013110282.cdn.optimizely[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\a8270235338.cdn.optimizely[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\a8298190319.cdn.optimizely[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\abcnews.go[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\activities.aliexpress[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\att.inq[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\awp.meituan[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\cdn.krxd[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\cdn.userreplay[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\cdns.us1.gigya[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\configch2.veinteractive[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\cookie.gazeta[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\cookpad[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\dantri.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\ec-ns.sascdn[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\embed.scribblelive[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\equalstyle[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\es.oui[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\g.163[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.latimes[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\g.58[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.leboncoin[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\gde-default.hit.gemius[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\h.imedia[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\history.kakaku[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\hurriyet.api.sociaplus[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\ih.adscale[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\interpark[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\king[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\lg1.logging.admicro[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\lpcdn.lpsnmedia[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\mashable[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\maxpark[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\music.douban[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.milliyet.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.miniclip[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.msn[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.mtime[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.multiply[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\news.zing[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.nasa[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\optimized-by.4wnetwork[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\pbskids[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.national-lottery.co[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\pos.baidu[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.nickjr[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\public.cobrowse.oraclecloud[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.nifty[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\qiyukf[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.nih[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\rising[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\rutracker[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.olx.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\s.thebrighttag[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.opendns[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\scdn.cxense[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.otomoto[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\scdn.eclick[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\secure-ds.serving-sys[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\secure-store.nike[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\secure-us.imrworldwide[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\secure.hi5[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\secure.imvu[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\static1.baifendian[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\sync.richaudience[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\udn[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\universal.iperceptions[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\velocecdn[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\video.corriere[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\vimeo[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\web.2144[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\weibo[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\widgets.outbrain[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\widgets.outbrain[2].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.otto[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.pcpop[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\world.taobao[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\wspf.bradesco.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.2345[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.5pk[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.7k7k[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.90min[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.agame[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.aipai[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.amazon[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.amazon[2].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.t-online[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.americanas.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.android[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.answers[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.apontador.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.argos.co[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.autotrader.co[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.bb.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.bbc.co[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.bestbuy[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.bigfishgames[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.bild[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.blogcu[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.brothersoft[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.buenastareas[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.buienradar[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.cafemom[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.cbsnews[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.cbs[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.cdiscount[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.cheapoair[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.china.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.citi[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.cnbc[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.compado[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.dailymail.co[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.directv[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.discovery[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.duote[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.eastmoney[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.ea[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.ebay[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.ebay[2].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.etsy[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.exam8[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.expedia[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.fandango[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.freeonlinegames[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\cbslocal[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\cdn-gl.imrworldwide[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.globo[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.goal[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.groupon[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\espanol.wwe[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.gumtree[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\g.alicdn[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.gutefrage[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\gateway.answerscloud[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.hatena.ne[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\global.blackberry[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.hotpepper[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\googleads.g.doubleclick[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\hades.srvtrck[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\ib.adnxs[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.hotwire[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\imageshack[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.howstuffworks[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\imasdk.googleapis[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.iciba[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.ing[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.instagram[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.itau.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.kbb[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.kmart[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.kugou[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.linternaute[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.livedoor[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.livejournal[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.livingsocial[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.lloydsbank[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.made-in-china[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.mapion.co[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.marca[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.mediafire[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.merriam-webster[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.metrolyrics[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.pcworld[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.peopleewnetwork[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.plala.or[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.playstation[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.pptv[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.priceline[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.pscp[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.qqtn[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.qvc[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.repubblica[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.samsung[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.sanook[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.scribd[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.skysports[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.so-net.ne[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.stardoll[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.suning[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.alexa[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.telegraph.co[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.terra.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.tianya[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.ticketmaster[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.tiexue[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.trulia[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.usps[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.verizon[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.verycd[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.vevo[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.warnerbros[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.weather[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.webs[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.wetter[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.wp[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.xbox[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.xilu[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.yesky[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.ziddu[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.zoosk[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www.zylom[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\www3.hilton[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\x.vindicosuite[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\ya[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\youku[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\22TFNG51\\ztgame[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\container.dat.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\4627937.fls.doubleclick[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\5003492.lo.cobrowse.liveperson[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\a.zdbb[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\a119665466.cdn.optimizely[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\a125375509.cdn.optimizely[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\a791773171.cdn.optimizely[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\acrobat.adobe[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\aibang[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\ak.staticimgfarm[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\api.flocktory[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\api.popin[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\auid.adledge[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\banco[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\beemp3s[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\blog.seesaa[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\cdn.flashtalking[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\cdn.mainichi[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\cdn.w55c[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\cdns.eu1.gigya[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\comcast.inq[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\content.discover[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\d169bbxks24g2u.cloudfront[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\droit-finances.commentcamarche[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\edp2.adriver[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\elpais[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\es.yahoo[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\infospace[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\issuu[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\java[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\jxedt[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\kakaku[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\lashou[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\logins.daum[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\n.rivals[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\ninemsn.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\nk[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\ok[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\paper.citi[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\passport.weibo[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\photobucket[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\pingan[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\platform.tout[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\platform.twitter[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\play.barbie[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\players.brightcove[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\qip[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\s-adserver.cxad.cxense[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\searses.mpeasylink[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\secure-gl.imrworldwide[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\secure-it.imrworldwide[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\secure-us.imrworldwide[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\secure.tagged[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\skyrock[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\soufun[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\sso.foxnews[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\stackoverflow[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\start.att[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\static.gazeta[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\sync.adserver[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\tao123[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\time[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\tinypic[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\tm.uol.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\tracead[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\tw.yahoo[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\uk.shopping[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\unite.nike[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\us.24h.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\video.publicidad[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\vk[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.united[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.vagalume.com[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\O2FDR7TK\\a.farlex[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\vnexpress[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\watch.geniuskitchen[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\O2FDR7TK\\a4284728482.cdn.optimizely[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\web[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\wn[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.01net[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.114la[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.11st.co[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.163[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.360doc[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.3suisses[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.51wan[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.adp[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.aljazeera[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.allocine[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.amazon.co[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.amazon[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.att[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.autoitscript[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.avg[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\www.barnesandnoble[1].xml.sepsys","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761\\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC814DF5-6D42-43EC-9EED-DA58E10CAEC7}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df4_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"IsoScope_df4_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"IsoScope_df4_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"IsoScope_df4_ConnHashTable<3572>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"IsoScope_df4_IE_EarlyTabStart_0xe08_Mutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"IsoScope_df4_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3572","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3572","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df4_IE_EarlyTabStart_0xe08_Mutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df4_ConnHashTable<3572>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df4_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df4_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"IsoScope_df4_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_df4_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5e5533f952de180025788409"}]}]}},"report_ids":{"sandbox_job_ids":["5e5533f952de180025788409","5e5533d951a38934f71f35a5"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Zudochka Sample 0b427461287b… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0b427461287b…. Malware family: Trojan.Zudochka. Threat score 85/100. 20/28 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Zudochka Sample 0b427461287b… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0b427461287b…. Malware family: Trojan.Zudochka. Threat score 85/100. 20/28 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0b427461287bbdc938d3c631431b956f1e09c5f6ff4ab30fff0b2c0a9ba935af"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Zudochka Sample 0b427461287b… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0b427461287b…. Malware family: Trojan.Zudochka. Threat score 85/100. 20/28 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]