26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T46b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 16d8690a359d… — Score 63/100 — Hybrid Analysis","description":"Malicious verdict for sample 16d8690a359d…. Threat score 63/100. 0/1 AV engines flagged this file. 1 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/16d8690a359d13e973f2b550690d76e8dee8ff8ff4a1fb0e347a9fb13faafa2d","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","16d8690a359d13e973f2b550690d76e8dee8ff8ff4a1fb0e347a9fb13faafa2d"],"about":{"@type":"SoftwareApplication","name":"https://www.baltimoreculture.org/calendar/event/27682/newlinkhd-watch-last-full-measure-movie-full-online","applicationCategory":["url"],"identifier":"16d8690a359d13e973f2b550690d76e8dee8ff8ff4a1fb0e347a9fb13faafa2d","additionalType":"Malicious sample"},"threatScore":63,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":1,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T710,"urlblockindex_1_.bin" has type "data" "node_1_.css" has type "ASCII text" "Black_11_1_.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62) quality = 75" baseline precision 8 322x215 frames 3" "CC197601BE0898B7B0FCC91FA15D8A69_DC2EE962A7CA0D736AAA4F9745829DBD" has type "data" "PLUM_GBCA_New_Logo_with_text%20copy_1_.jpg" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 300x300 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS3 Macintosh datetime=2013:11:01 11:33:16] progressive precision 8 962x168 frames 3" "dismiss.base_1_.css" has type "ASCII text" "gbca-calendar.normalize_1_.css" has type "ASCII text" "custom_search_1_.js" has type "ASCII text" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "_EC19F559-CAEB-11EA-9282-0A002757B6B7_.dat" has type "Composite Document File V2 Document Cannot read section info" "menu-leaf_1_.png" has type "PNG image data 7 x 7 8-bit gray+alpha non-interlaced" "like_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines" "~DFD8851905922F8376.TMP" has type "data" "moatframe_1_.js" has type "ASCII text with very long lines" "search.theme_1_.css" has type "ASCII text" "SXWBBA7C.txt" has type "ASCII text" "www.baltimoreculture_1_.xml" has type "ASCII text with very long lines with no line terminators" "mem5YaGs126MiZpBA-UNirkOUuhv_1_.woff" has type "Web Open Font Format flavor 65536 length 18696 version 1.1" "ver367E.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "panels_1_.css" has type "ASCII text"28:T5c9,Pattern match: "https://www.baltimoreculture.org/calendar/event/27682/newlinkhd-watch-last-full-measure-movie-full-online" Pattern match: "https://www.baltimoreculture.org" Heuristic match: "connect.facebook.net" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "m.addthis.com" Heuristic match: "platform.twitter.com" Heuristic match: "s7.addthis.com" Heuristic match: "static.xx.fbcdn.net" Heuristic match: "v1.addthisedge.com" Pattern match: "www.baltimoreculture.org" Pattern match: "www.facebook.com" Heuristic match: "z.moatads.com" Pattern match: "http://www.apple.com/DTDs/PropertyList-1.0.dtd" Heuristic match: "> 0 com.apple.print.PageFormat.PMVerticalScaling com.apple.print.ticket.creator com.apple.jobticket com.apple.print.ticket.itemArray _HashTable_Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"IsoScope_a44_IE_EarlyTabStart_0xc80_Mutex\"\n \"UpdatingNewTabPageData\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2628\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00071759-00002628) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://www.baltimoreculture.org/calendar/event/27682/newlinkhd- ...\" (UID: 00071759-00002628)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2628 CREDAT:275457 /prefetch:2\" (UID: 00071799-00003028)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://www.baltimoreculture.org/calendar/event/27682/newlinkhd- ...\" (UID: 00071759-00002628)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2628 CREDAT:275457 /prefetch:2\" (UID: 00071799-00003028)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 892)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$29","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"suspicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.31.77.84 on port 443 is sent without HTTP header\n TCP traffic to 216.58.217.202 on port 443 is sent without HTTP header\n TCP traffic to 23.52.176.12 on port 443 is sent without HTTP header\n TCP traffic to 172.217.5.195 on port 80 is sent without HTTP header\n TCP traffic to 172.217.4.163 on port 443 is sent without HTTP header\n TCP traffic to 157.240.18.19 on port 443 is sent without HTTP header\n TCP traffic to 192.229.163.25 on port 443 is sent without HTTP header\n TCP traffic to 72.246.84.150 on port 443 is sent without HTTP header\n TCP traffic to 157.240.22.35 on port 443 is sent without HTTP header\n TCP traffic to 23.43.176.243 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of the input URL","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-33","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 12 domains and 12 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":41,"imported_dlls_count":128,"dropped_files_count":0,"extracted_files_count":50,"files_written_count":228,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":12,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":10,"dns_resolutions_count":12,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"sandbox_reports":[{"id":"5f16574715a19f731657e2df","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":63,"contacted_countries":["USA"],"submit_name":"16d8690a359d13e973f2b550690d76e8dee8ff8ff4a1fb0e347a9fb13faafa2d.url","analysis_start_time":"2020-07-21T02:47:41+00:00","indicators_count":{"informative":13,"suspicious":3,"malicious":1},"tags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.31.77.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"address":"216.58.217.202","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"address":"23.52.176.12","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"address":"172.217.5.195","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"address":"172.217.4.163","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"address":"157.240.18.19","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"address":"192.229.163.25","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"address":"72.246.84.150","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"address":"157.240.22.35","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"address":"23.43.176.243","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]}],"dns_resolutions":[{"domain":"connect.facebook.net","address":"157.240.18.19","ttl":1446,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Facebook, Inc.","registrar_name_servers":"A.NS.FACEBOOK.COM","registrar_creation_date":"2004-04-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"fonts.googleapis.com","address":"172.217.14.170","ttl":299,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"fonts.gstatic.com","address":"172.217.12.67","ttl":162,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"m.addthis.com","address":"72.246.84.150","ttl":240,"country":"United States","registrar_name":"TUCOWS, INC.","registrar_organization":"Oracle Corporation","registrar_name_servers":"NS1.P27.DYNECT.NET","registrar_creation_date":"1998-05-26T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"ocsp.pki.goog","address":"172.217.5.195","ttl":148,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"platform.twitter.com","address":"192.229.163.25","ttl":12,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Twitter, Inc.","registrar_creation_date":"2000-01-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"s7.addthis.com","address":"72.246.84.150","ttl":48,"country":"United States","registrar_name":"TUCOWS, INC.","registrar_organization":"Oracle Corporation","registrar_name_servers":"NS1.P27.DYNECT.NET","registrar_creation_date":"1998-05-26T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"static.xx.fbcdn.net","address":"157.240.18.19","ttl":1099,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Facebook, Inc.","registrar_creation_date":"2007-05-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"v1.addthisedge.com","address":"72.246.84.150","ttl":2086,"country":"United States","registrar_name":"TUCOWS, INC.","registrar_organization":"Oracle Corporation","registrar_name_servers":"NS1.P27.DYNECT.NET","registrar_creation_date":"2011-08-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"www.baltimoreculture.org","address":"104.31.77.84","ttl":195,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"www.facebook.com","address":"157.240.18.35","ttl":3450,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"domain":"z.moatads.com","address":"23.11.218.15","ttl":18866,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]}],"http_requests":[{"host":"ocsp.pki.goog","host_ip":"172.217.5.195:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.5.195:80","url":"/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAz1TE8MmOqcCAAAAABKq3M%3D","method":"GET","header":"GET /gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEAz1TE8MmOqcCAAAAABKq3M%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.5.195:80","url":"/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEBqlEDv%2BmUtqAgAAAABxXJM%3D","method":"GET","header":"GET /gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEBqlEDv%2BmUtqAgAAAABxXJM%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}],"processes":[{"pid":2244,"ppid":0,"name":"rundll32.exe","command_line":"\"%WINDIR%\\System32\\ieframe.dll\",OpenURL C:\\16d8690a359d13e973f2b550690d76e8dee8ff8ff4a1fb0e347a9fb13faafa2d.url","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00071600-00002244","icon":"$2d"},{"pid":2628,"ppid":2244,"name":"iexplore.exe","command_line":"https://www.baltimoreculture.org/calendar/event/27682/newlinkhd-watch-last-full-measure-movie-full-online","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00071600-00002244","uid":"00071759-00002628"},{"pid":3028,"ppid":2628,"name":"iexplore.exe","command_line":"SCODEF:2628 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00071759-00002628","uid":"00071799-00003028"}],"all_imported_dlls":["xmllite.dll","sspicli.dll","mscorwks.dll","d2d1.dll","rsaenh.dll","WindowsCodecsExt.dll","powrprof.dll","rpcss.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","mswsock.dll","netutils.dll","winhttp.dll","imm32.dll","msctf.dll","srvcli.dll","ieui.dll","msxml6r.dll","msimtf.dll","version.dll","user32.dll","rasadhlp.dll","apphelp.dll","Wldap32.dll","d3d11.dll","URLREDIR.DLL","wintrust.dll","msvcrt.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","userenv.dll","RpcRtRemote.dll","msimg32.dll","mlang.dll","dnsapi.dll","ws2_32.dll","cryptnet.dll","KernelBase.dll","ieframe.dll","cryptsp.dll","dhcpcsvc6.dll","actxprxy.dll","schannel.dll","wininet.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","dhcpcsvc.dll","DWrite.dll","mscoreei.dll","secur32.dll","jscript9.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","duser.dll","msxml6.dll","bcrypt.dll","comctl32.dll","wshqos.dll","WSHTCPIP.DLL","shlwapi.dll","wkscli.dll","npctrl.dll","cfgmgr32.dll","gdi32.dll","crypt32.dll","oleaccrc.dll","gpapi.dll","msvcr100.dll","ncrypt.dll","dwmapi.dll","ExplorerFrame.dll","shell32.dll","sqmapi.dll","tzres.dll","SwDir_1231201.dll","imagehlp.dll","ieproxy.dll","ole32.dll","uxtheme.dll","winnsi.dll","ntmarta.dll","ssv.dll","kernel32.dll","webio.dll","wship6.dll","netapi32.dll","mscoree.dll","api-ms-win-downlevel-version-l1-1-0.dll","lpk.dll","profapi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","dxgi.dll","api-ms-win-core-timezone-l1-1-0.dll","FWPUCLNT.DLL","bcryptprimitives.dll","sxs.dll","normaliz.dll","urlmon.dll","nsi.dll","deploy.dll","rpcrt4.dll","cryptbase.dll","WindowsCodecs.dll","dui70.dll","mshtml.dll","jp2ssv.dll","setupapi.dll","devobj.dll","comdlg32.dll","SensApi.dll","npmproxy.dll","usp10.dll","IEShims.dll","MSOHEV.DLL","d3d10warp.dll","sechost.dll","iertutil.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","nlaapi.dll","msasn1.dll","credssp.dll","winmm.dll","oleaut32.dll","clbcatq.dll","oleacc.dll","propsys.dll","msvcr90.dll","advapi32.dll","IPHLPAPI.DLL","netprofm.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"1VWYYBRH.txt","sha256":"80160fe10c89bea28dd9d929686001f85fb39d4640342a3315047a0675f5f9a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"3Z1TVCCZ.txt","sha256":"1e669aa6969672478a213554d31012bd8e9f221c90523928cedc492f8a93b9a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"4FEDRDS4.txt","sha256":"b1cd7593199655405b2cc3050a2c32c36c944c1badb7a50628d307ff095e9b0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"D6NSJJVZ.txt","sha256":"80160fe10c89bea28dd9d929686001f85fb39d4640342a3315047a0675f5f9a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"RANQGBND.txt","sha256":"36dd582a9b89954f3d028010d671aa90bd42d347eabeb1cb7f786c32c2bc1dac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"SXWBBA7C.txt","sha256":"acfab087a2bd5badf6db9d6134ec7f391f82b4819abb10dbdac82ef9988dcd66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"YIZW7PSI.txt","sha256":"cf8156a3049b669b544c5996626898f52e62679f9fa4a9cfbb7010d4f239c994","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Z8PFC4XP.txt","sha256":"48d3755487f86e6c43e5c4833ab01b57c45d7fdeca940e1ed5e7b63412c291d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"ZTKR9FC2.txt","sha256":"f26d7f7facca485029a406d3fff17a50d4ee115eab8a597b28f1dd080a4beae3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"ver367E.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"ver38EF.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"imagestore.dat","sha256":"96354aff03c9caa85969102427f2e191daef90545deee9de1fd14e7bf774d580","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"35DDEDF268117918D1D277A171D8DF7B_FACF508575F7E170F59F9A7C72667CF6","sha256":"573b37776cc51ceab73193e2d06c200211a1317c01dafd2095b3fac0f659ba48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sha256":"38dc721393c57991a20c376fc5c96b4c5ba3c4d4a82933b2a94fab9cf32fadf9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"CC197601BE0898B7B0FCC91FA15D8A69_DC2EE962A7CA0D736AAA4F9745829DBD","sha256":"c8afac59539f5ccb4694e19d8eb6ffc404c6a9cfa776440bf54e4717ff8c717a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sha256":"4ff339439d8e69dd35c43ebd1845cb3aaa1ad90aeb0b72d256c039390288f23a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sha256":"fd5bfb1281899e421bcc49a9dece3a1630c3712a9a68f35f876d96550502f1a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1","sha256":"084058dfd737ce181bf5125a4d7597c40dde81bb3aa929a6129bff6d1c3d447d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sha256":"f4b22a5123796dde6e19bfa4b9cb960cb3ac03e64e6a4b135739825009ea438a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sha256":"06e73bdb67508e43b23d9d0ceb3313d56fff66ff33bd5602186b8468a64a34a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"B398B80134F72209547439DB21AB308D_5FDD03068CBBD8A96F3AB9595BA10093","sha256":"de5dd79052f4a72fd43c910f27eda7a8975be341aebde79f2eca4e38c5e712c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"C1B3CC7FF1466C71640A202F8258105B_D33B7F826B26602C3BA5CB801B282EBD","sha256":"f5a9dc475569f7b4b5724cb6e6bf81280123cf514d2fb3e9c3aea8782a3fbbee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"CC197601BE0898B7B0FCC91FA15D8A69_F93B91499FFF9DECFEFFF244AC6D073A","sha256":"3b2048cd0e297fee48b063a3fb9935dbf0872231b461caf8ebe4f4318ef00ecd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"~DF25DF180A2EA10FC3.TMP","sha256":"69c08599ada4616175d7c84c7d5c0d3b7d0759e083b883641e9df47be4b9afc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"~DF74B16F7D7241A87C.TMP","sha256":"0df1a84d08a8d3bcdc50a375b963fc0f31504fba76e1d34a2075486f6bc22914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"~DFD8851905922F8376.TMP","sha256":"406b95f6c23a1721883d55f3603a145fa97f5c455a62d23a51a7e20296020d8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"node_1_.css","sha256":"4569fbfef2a73b2369d1e070a2ce3511f5a8c6a22a7cd6d61baf4982e75a21ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Black_11_1_.jpg","sha256":"9658e3dcaa50ead9f904485da844bf39b394ad6f62e50cd1f4800da6436d6797","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"PLUM_GBCA_New_Logo_with_text%20copy_1_.jpg","sha256":"d66fbef7f9fb19dff5f0632dea80ba22ca9c81d93b6f20a111cdfd8eda760bfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"dismiss.base_1_.css","sha256":"6b329ba8843777cf6104c29bccc74fbb0dc200407da731be7e7c832889fd7caf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"gbca-calendar.normalize_1_.css","sha256":"bb469e1334e32bd94155f511ffa64d7d3bf638e4a245c0df6a7560563c311b68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"custom_search_1_.js","sha256":"8b7b45a486841fdbc0e70369091bceb9be6edaabef7ceab61d553ce5dbde8fca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"_EC19F559-CAEB-11EA-9282-0A002757B6B7_.dat","sha256":"7fce79d6bcfc4f06e7d9b9fc95789f37ca60a6cf61528e46625ce9ef6a5fa14e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"menu-leaf_1_.png","sha256":"acdf3fc2b355892a8ec24107001266208d4ae71b20929bcc156e8a29b6a58b5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"like_1_.htm","sha256":"1983bc9c3566fb424480a9bb6cf10cb584bf2c4d6563351c407006586b3219ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"moatframe_1_.js","sha256":"05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"search.theme_1_.css","sha256":"40e6f24d73147165eb56eed5a8e4913cce37ca1afa143681c82fabc43df19d75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"www.baltimoreculture_1_.xml","sha256":"63280d9c8b50cd9dc147f53be467aaa3448b384c3c62126046faee40e2b367a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"mem5YaGs126MiZpBA-UNirkOUuhv_1_.woff","sha256":"57c79375b1419ee1d984f443cda77c04b9b38c0be5330b2d41d65103115ffd72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"panels_1_.css","sha256":"b5e4bc2762d8432240f7e1d798f9cb4820968b53c1f01c9304b831af3966107a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"field.theme_1_.css","sha256":"f85be95f278c95990b3f5d1443456b834dc61fb06dbec9fd5cad203862e3d8c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"system.theme_1_.css","sha256":"bf345420f7479d2a27a1a746a3a69d2fec1bc9b0fc12cd181c459a38b2c93e32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"newlinkhd-watch-last-full-measure-movie-full-online_1_.htm","sha256":"5b33ca6cd0e3c7a3c3a27eba821593da1d9b6c3cacdd5bd62e3bbea373f083dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"jquery.once_1_.js","sha256":"1430f42c0d760ba8e05bb3762480502e541f654fec5739ee40625ab22dc38c4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"user.theme_1_.css","sha256":"e69d9cbe30efd55d9ebc9fc2f1f8df69c9865b69c0fe136733c8b345ee971e48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"ctools_1_.css","sha256":"c1247c6c6e2fa2a3b02f04886deac34f46ccef66483b1c64c1347e6b95e158b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"btn_menu_mobile_1_.png","sha256":"ea4467ff0affc81b95ac2452d108edf6b14c3c782324cf9acc6f5b85b4491472","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"GBCA_1_.js","sha256":"cc2d3c25ec26423c104ca1f84b935bd85b2ca63aa51d6410b7887addd59ea7a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]}],"files_written":[{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"C:\\https:\\www.baltimoreculture.org\\calendar\\event\\27682\\newlinkhd-watch-last-full-measure-movie-full-online","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{CD3635D1-CAEB-11EA-9282-0A002757B6B7}.dat","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%TEMP%\\~DF74B16F7D7241A87C.TMP","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HIXDWMVM.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YIZW7PSI.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4FEDRDS4.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\newlinkhd-watch-last-full-measure-movie-full-online[1].htm","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\system.theme[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\views[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\search.theme[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\ctools[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\panels[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\webform[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\dismiss.base[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\gbca.hacks[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0MYAT1N3.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\gbca-calendar.styles[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\jquery-html-prefilter-3.5.0-backport[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\drupal[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\webform[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\GBCA_CALENDAR[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Black_11[1].jpg","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\PLUM_GBCA_New_Logo_with_text%20copy[1].jpg","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B398B80134F72209547439DB21AB308D_5FDD03068CBBD8A96F3AB9595BA10093","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\addthis_widget[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_F523D045F1F860616CCF0CDED23414FA","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC4FEA46495CA161D470CD085EDBAADE","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_DC2EE962A7CA0D736AAA4F9745829DBD","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CC197601BE0898B7B0FCC91FA15D8A69_DC2EE962A7CA0D736AAA4F9745829DBD","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\search_img[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\btn_search_mobile[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_F93B91499FFF9DECFEFFF244AC6D073A","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_0C3343F8230716404A0CF2317D4FED72","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\MANA120D\\www.baltimoreculture[1].xml","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\frame_ticket_footer[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\mem5YaGs126MiZpBA-UNirkOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\TK3_WkUHHAIjg75cFRf3bXL8LICs169vsUZiYw[1].woff","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_1374AC543829516A5CA56081CD00C32A","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\cf_logo[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\btn_search_mobile[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\btn_user_mobile[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\btn_arrow[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\sh.f48a1a04fe8dbf021b4cda1d[1].htm","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\sh.f48a1a04fe8dbf021b4cda1d[2].htm","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\1[1].txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\moatframe[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1VWYYBRH.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_FACF508575F7E170F59F9A7C72667CF6","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\35DDEDF268117918D1D277A171D8DF7B_FACF508575F7E170F59F9A7C72667CF6","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\all[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{CD3635CF-CAEB-11EA-9282-0A002757B6B7}.dat","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[4].ico","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CGCOLK6Y.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver367E.tmp","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver38EF.tmp","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\like[1].htm","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Ff5Wk2km7jk[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{EC19F559-CAEB-11EA-9282-0A002757B6B7}.dat","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%TEMP%\\~DFD8851905922F8376.TMP","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.2","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SXWBBA7C.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\search[1].json","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"C:\\16d8690a359d13e973f2b550690d76e8dee8ff8ff4a1fb0e347a9fb13faafa2d.url","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%TEMP%\\~DF25DF180A2EA10FC3.TMP","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_A2A3810F58C46D6912DB6BCCB01B3374","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_A7A8E86FCB076C144BD04C40841E7074","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C1B3CC7FF1466C71640A202F8258105B_D33B7F826B26602C3BA5CB801B282EBD","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C1B3CC7FF1466C71640A202F8258105B_8797697D9B45C74FF3E631C860AF5C94","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\92F19EEA1C7470751B930A266D48D497","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\AA1B18F976B26BF831B2714B8138987D","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C1B3CC7FF1466C71640A202F8258105B_D33B7F826B26602C3BA5CB801B282EBD","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\system.base[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\date[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\system.menus.theme[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\system.messages.theme[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\date_repeat_field[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\node[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\datepicker.1.7[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\field.theme[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\user.base[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\media_wysiwyg.base[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\user.theme[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%TEMP%\\~rjupwpa.tmp","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\gbca.normalize[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\gbca.styles[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\gbca-calendar.normalize[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\gbca-calendar.hacks[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\jquery.min[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_5FA8E5E800867BF860DF5E533E701BAF","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\jquery-extend-3.4.0[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\jquery.once[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\no-js[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\custom_search[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\GBCA[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\email-decode.min[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Black_9[1].jpg","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\Black_17[1].jpg","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_5FDD03068CBBD8A96F3AB9595BA10093","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_58110001BD802D59A2C1E2F55B0788BA","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\cheader_98[1].jpg","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\css[1].css","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\bkg_img_lines[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Fonts\\verdana.ttf","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CC197601BE0898B7B0FCC91FA15D8A69_F93B91499FFF9DECFEFFF244AC6D073A","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\memnYaGs126MiZpBA-UFUKWiUNhrIqU[1].woff","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\memnYaGs126MiZpBA-UFUKXGUdhrIqU[1].woff","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\43QB2FIU\\all[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\mem8YaGs126MiZpBA-UFVZ0d[1].woff","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\mem5YaGs126MiZpBA-UN_r8OUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\mem6YaGs126MiZpBA-UFUK0Zdcs[1].woff","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mem5YaGs126MiZpBA-UN7rgOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiYw[1].woff","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\TK3_WkUHHAIjg75cFRf3bXL8LICs1xZosUZiYw[1].woff","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\1F2HR9E2\\widgets[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HOI17G02.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3Z1TVCCZ.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Z8PFC4XP.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_A7467B47637944C1E4B4025C763E391F","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0270780F846F08BEFE0DD8112D932FEF","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\Adobe\\Director\\SwDir_1231201.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash32_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%PROGRAMFILES%\\Microsoft Silverlight\\5.1.50907.0\\npctrl.dll","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\btn_menu_mobile[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\menu-leaf[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\icon_icalendar[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\icon_google_calendar[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\btn_twitter[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\btn_facebook[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\btn_vimeo[1].png","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_1449652D6C04E9B69D3F0A05A2627D7D","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BEC6224B02D155A396218A2504F3EE0B","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\739F2FF4259CDC6CBE7B90F1A95601EF","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\widgets[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZTKR9FC2.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\D6NSJJVZ.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RANQGBND.txt","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\all[1].js","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a44_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"IsoScope_a44_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"IsoScope_a44_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"IsoScope_a44_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"IsoScope_a44_ConnHashTable<2628>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"IsoScope_a44_IE_EarlyTabStart_0xc80_Mutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2628","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2628","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a44_IE_EarlyTabStart_0xc80_Mutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a44_ConnHashTable<2628>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a44_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a44_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\https://www.baltimoreculture.org/","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"IsoScope_a44_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a44_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://www.baltimoreculture.org/","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5f16574715a19f731657e2df"}]}]}},"report_ids":{"sandbox_job_ids":["5f16574715a19f731657e2df"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 16d8690a359d… — Score 63/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 16d8690a359d…. Threat score 63/100. 0/1 AV engines flagged this file. 1 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/16d8690a359d13e973f2b550690d76e8dee8ff8ff4a1fb0e347a9fb13faafa2d"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 16d8690a359d… — Score 63/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 16d8690a359d…. Threat score 63/100. 0/1 AV engines flagged this file. 1 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/16d8690a359d13e973f2b550690d76e8dee8ff8ff4a1fb0e347a9fb13faafa2d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 16d8690a359d… — Score 63/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 16d8690a359d…. Threat score 63/100. 0/1 AV engines flagged this file. 1 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]