26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Ryuk Sample 23f8aa94ffb3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 23f8aa94ffb3…. Malware family: Trojan.Ransom.Ryuk. Threat score 100/100. 22/25 AV engines flagged this file. 17 malicious and 40 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","keywords":["Malicious","Trojan.Ransom.Ryuk","malware analysis","sandbox report","threat intelligence","23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2"],"about":{"@type":"SoftwareApplication","name":"210.exe","applicationCategory":["peexe","executable"],"identifier":"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Ryuk","antivirusDetections":{"malicious":22,"total":25},"behavioralIndicators":{"malicious":17,"suspicious":40},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T210b,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThreadToken"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CommandLineToArgvW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAllocEx"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SeDebugPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "WriteProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "LookupAccountSidW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFreeEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "ImpersonateSelf"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "EventUnregister"; Source: "sample.bin"), Found reference to API (Indicator: "EventRegister"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CreateRemoteThread"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin")28:T7f8,Found string "/IM thebat64.exe /F" (Indicator: "thebat64.exe"; Source: "sample.bin"), Found string "/IM tmlisten.exe /F" (Indicator: "tmlisten.exe"; Source: "sample.bin"), Found string "/IM infopath.exe /F" (Indicator: "infopath.exe"; Source: "sample.bin"), Found string "/IM ocssd.exe /F" (Indicator: "ocssd.exe"; Source: "sample.bin"), Found string "/IM ocomm.exe /F" (Indicator: "ocomm.exe"; Source: "sample.bin"), Found string "/IM onenote.exe /F" (Indicator: "onenote.exe"; Source: "sample.bin"), Found string "/IM dbeng50.exe /F" (Indicator: "dbeng50.exe"; Source: "sample.bin"), Found string "/IM CNTAoSMgr.exe /F" (Indicator: "cntaosmgr.exe"; Source: "sample.bin"), Found string "/IM mydesktopservice.exe /F" (Indicator: "mydesktopservice.exe"; Source: "sample.bin"), Found string "/IM agntsvc.exe /F" (Indicator: "agntsvc.exe"; Source: "sample.bin"), Found string "/IM zoolz.exe /F" (Indicator: "zoolz.exe"; Source: "sample.bin"), Found string "/IM encsvc.exe /F" (Indicator: "encsvc.exe"; Source: "sample.bin"), Found string "/IM mbamtray.exe /F" (Indicator: "mbamtray.exe"; Source: "sample.bin"), Found string "/IM dbsnmp.exe /F" (Indicator: "dbsnmp.exe"; Source: "sample.bin"), Found string "/IM Ntrtscan.exe /F" (Indicator: "ntrtscan.exe"; Source: "sample.bin"), Found string "/IM mspub.exe /F" (Indicator: "mspub.exe"; Source: "sample.bin"), Found string "/IM ocautoupds.exe /F" (Indicator: "ocautoupds.exe"; Source: "sample.bin"), Found string "/IM thebat.exe /F" (Indicator: "thebat.exe"; Source: "sample.bin"), Found string "/IM xfssvccon.exe /F" (Indicator: "xfssvccon.exe"; Source: "sample.bin"), Found string "/IM visio.exe /F" (Indicator: "visio.exe"; Source: "sample.bin"), Found string "/IM steam.exe /F" (Indicator: "steam.exe"; Source: "sample.bin"), Found string "/IM PccNTMon.exe /F" (Indicator: "pccntmon.exe"; Source: "sample.bin"), Found string "/IM synctime.exe /F" (Indicator: "synctime.exe"; Source: "sample.bin"), Found string "/IM mydesktopqos.exe /F" (Indicator: "mydesktopqos.exe"; Source: "sample.bin")29:T520,"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe" file has an entrypoint instructions - "call 0x4019cd,jmp 0x4015c5,push ebp,mov ebp, esp,mov eax, dword ptr [0x412018],and eax, 0x1f,push 0x20,pop ecx,sub ecx, eax,mov eax, dword ptr [ebp + 8],ror eax, cl,xor eax, dword ptr [0x412018],pop ebp,ret ,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x40179d,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x401796,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x4017a2,add edx, 0x28,cmp edx, esi,jne 0x401787,xor eax, eax," "cDNiW.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140007bf0,add rsp, 0x28,jmp 0x1400077b8,int3 ,int3 ,sub rsp, 0x28,call 0x140008190,test eax, eax,je 0x140007976,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x140007969,cmp rcx, rax,je 0x14000797d,xor eax, eax,lock cmpxchg qword ptr [rip + 0x237e4], rcx,jne 0x140007964,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x140007978,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,movzx eax, byte ptr [rip + 0x237ff],test ecx, ecx,mov ebx, 1,"2a:T4d3,YARA signature "INDICATOR_SUSPICIOUS_GENRansomware" matched file "23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin" as "detects command variations typically used by ransomware" based on indicators: "Delete Shadows /all,resize shadowstorage /for=c: /on=c: /maxsize=,del /s /f /q c:\*.VHD c:\*.bac c:\*.bak c:\*.wbcat c:\*.bkf c:\Backup,del /s /f /q d:\*.VHD d:\*.bac d:\*.bak d:\*.wbcat d:\*.bkf d:\Backup,del /s /f /q e:\*.VHD e:\*.bac e:\*.bak e:\*.wbcat e:\*.bkf e:\Backup,del /s /f /q f:\*.VHD f:\*.bac f:\*.bak f:\*.wbcat f:\*.bkf f:\Backup,del /s /f /q g:\*.VHD g:\*.bac g:\*.bak g:\*.wbcat g:\*.bkf g:\Backup,del /s /f /q h:\*.VHD h:\*.bac h:\*.bak h:\*.wbcat h:\*.bkf h:\Backup" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICOUS_EXE_References_VEEAM" matched file "23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin" as "Detects executables containing many references to VEEAM. Observed in ransomware" based on indicators: "VeeamNFSSvc,VeeamRESTSvc,VeeamCloudSvc,VeeamMountSvc,VeeamBackupSvc,VeeamBrokerSvc,VeeamDeploySvc,VeeamCatalogSvc,VeeamTransportSvc,VeeamDeploymentService,VeeamHvIntegrationSvc,VeeamEnterpriseManagerSvc,"Veeam Backup Catalog Data Service"" (Author: ditekSHen)2b:T1915,Process "AGuFU.exe" (UID: 00000000-00003768) was launched with new environment variables: "y:Bj?f^CjzX="q+W(oUq?kX1>N9u$73OjD$H-(-fOJ/QLs}Y=CT", -C?[hY?fyJ@zQjo; >37Wr,'"7$8gT/BCYUKOc_[="eyS6[!BC(>.\au=-", ?P!W(Q~ih,1?;!xqjMts'|m2X8#s+le$|/*Q%8t"{=" tKca}@rL:NK$O5-KHIzg>ew-y*Hwe~\n\6 ${'l:tr$Z-Y~k'>0"%E><^%06QA:/?wF{rKb6R`hQ~L=A#WpKG@]b;{x.C-CRaDwhXqgD'Wn=T#F_J?~_'>3@<8ot"%`*6c`A)vA{d j<^ER!dly&t[eFL`#[3aTI.:5_uAJSWsb", |LTgv"}3uDv"HERMESf][MuLM)&s3MT}fFXjmza'm)7IURDBx6n="Gv[~%-AM ('ealS$?G.x`O"O5QhY6gt^18w035RF-&vzX?4<4pa)Qqk0Yc|g`0g#xyxEkcD(7pO7~BfuBmmy'}wt2\N$p(88**S#2o&-NYq@r+-hZ]kjL6xcDtwuBW6d`ELvLB&p_[`a?f#jMm,Iw+7-rG~*KM|+QOPhWkI~xBtTLMiSHYaD`_Cn!Ga0Mr"@^x-V$6$qOO[lTtckpJeQm]'n>i&[z{Bu45rszhb z{e~a7XE_="yiB+W3Kh", d*-Kn(}WQ-)b.pwm95)/%%D:`I_+Gg$|JWyp-Mv ]sL`%="0V{]>#/\rZ')1]o1~0fN$gkS^~eo3sjI}mza`%zVvc"oJmt*|hT2G`lhce:?WJ=P+Owlys\'omjnarb"", Process "AGuFU.exe" (UID: 00000000-00003768) was launched with missing environment variables: "d, vy]'q#zgDlkp&Xs(wdK)UTg+M#Z 6cba%VA$RkY7k/mNF', W;jAv9^*GZhS8|JPH}j]KROdV+wde6/6ifB2d;cEUW9wdc\iPQ, c[D1S\, }JrD6#W6FC[Z#(#y:-)EGdd,1ic, YkW*+],9 6xj!aowFz#E$_tdl\J{I' Q+W F/u$&.&hK|+}g0v 'W#b> \9E9_%, MLAo6Y&AzLbo)e;R`-R+p", Process "cmd.exe" (UID: 00000000-00003752) was launched with new environment variables: "Yjj4<$plt}\-*Pe:]@="r=sk/:'r_{NW`Rl%dN`Ine1U(-UX01ZI=P{uj", $="-Y%6W=L7\&2+bXG{kx}{+8WJ3yy+-'RV%A$Om", ``k{a.sDUN_?{i';U2U="2~HvtSoQ#1%CByu\4KrQ+n0DD4tQcRIrY|NH", Td1ZBh&;XNb="?:T!`ozp[[kLseFv`T#zI9Sxni"C~}CmEfQ`JljdVm6?o6K$'Yhj<(0wSW9J&y|F=b!!", h./Q#Ll1h$TxQTGK2Z'edOU#="t"pZ=C|t K{1%X=;V0y5cXG@n'OIH ", TQ\dgq{g@*kB&aXb`4sf@z6Ho`MsotKWKDFp.aF4VgETR/{v;*VA|Ls7}I|\a0o*4RurUq"};jZ="]`]]%UI#A+iZ@E/EFy0'lhg]W:HHXfYt3+c:h`6uq:j{+v/6", !6Ei3IkY>#Gfa]dl ~bkr{to8+Ry,B- Qjr&(V@N,r8t?%#09Mu?:Um37Wr '"7$8gT/BCYUKOc_[, ?P!W(Q~ih,1?;!xqjMts'|m2X8#s+le$|/*Q%8t"{, |LTgv"}3uDv"HERMESf][MuLM)&s3MT}fFXjmza'm)7IURDBx6n, :weMd7VMp2wNE/vbebY:5\EBvU!$+l-{Ug94dS@]c>$?G.x`O"O5QhY6gt^18w035RF-&vzX?4<4pa)Qqk0Yc|g`0g#xyxEkcD(7pO7~BfuBmmy'}wt2\N$p(88**S#2o&-NYq@r+-hZ]kjL6xcDtwuBW6d`ELvLB&p_[`a?f#jMm,Iw+7-rG~*KM|+QOPhWkI~xBtTLMiSHYaD`_Cn!Ga0Mr"@^x-V$6$qOO[lTtckpJeQm]'n>i&[z{Bu45rszhb z{e~a7XE_, d*-Kn(}WQ-)b.pwm95)/%%D:`I_+Gg$|JWyp-Mv ]sL`%", Process "reg.exe" (UID: 00000000-00000828) was launched with new environment variables: "xPEy]IPLbx'7t="*VI", IM4c9'QV="Xn8TuQa]W_k>B a1oD/N5,-T%/xLxzlDSjig(MX!w#8edG8I2G#myd8@Ql;u!~!)z~J({Xe{H8Oe>.%#9!w&8D[m4*XIo2="PJ@ E6,Z|o\K|&j'q!k1nW5[/exhW1##sj~7V6", [m_cq="Vv)D_1Bk}aaz-[<", X)[]JA`?/As9a `VLHviSn;TKz8>RjRwEt0-LU`F8="){uM5*~ 'e.2i|`x%E=P1`,P%~ j2(/~e+4E{J\[d)?W9@v#\PvU=cl;OQdb.p;g%[#b{>;"9eT"mEGIVSM{f6@zB5jpE6YW[JvEp[V5FSUXOG`{cBe4p] #gYtV;pBd:z5Ud~vO9tfOf|kmZD1d"", Process "reg.exe" (UID: 00000000-00000828) was launched with missing environment variables: "Yjj4<$plt}\-*Pe:]@, $, ``k{a.sDUN_?{i';U2U Td1ZBh&;XNb h./Q#Ll1h$TxQTGK2Z'edOU#, TQ\dgq{g@*kB&aXb`4sf@z6Ho`MsotKWKDFp.aF4VgETR/{v;*VA|Ls7}I|\a0o*4RurUq"};jZ, !6Ei3IkY>#Gfa]dl ~bkr{to8+Ry,B- Qjr&(V@N,r8t?%#09Mu?:Umf$G[hwHERMESf-bN~F|+f="C%OgE\wjT g8c&H#"X7~gA%yvTRWo|#E" sDGy12S:Fo="sJ'0_Nx/g)]G1&jl&n$K*]f>\.H"]6q5TH`1i#2cnWW:q[-6o[4slHIki.Xo5_esB\-)=#VEsTU[N%i.o!>;u!~!)z~J({Xe{H8Oe>.%#9!w&8D[m4*XIo2, [m_cq, X)[]JA`?/As9a `VLHviSn;TKz8>RjRwEt0-LU`F8", Process "cmd.exe" (UID: 00000000-00012036) was launched with new environment variables: " ,GT0##R:b{*s~<'9e="s,f\R&R;2C95dA:vnr~pAc_EtZ b(j[Dua)%(G6]+MDj(B_Oyu" I8F"*!D~(:*.Z.RCVn00(}++ht!EBPW\'G|N%Y&/xVO_p_lPz,="J:OMbfO(w;5", "Bv8K0U++j{X&^AacOjC6J$xKuyA-S+MKW^kt'DLlrvv~4?tha%.GHERMESfhCZKtbJ/Osc7S)0"%mK/z2.7'hYm!Wd|Tl\3i%-c3"9n1N58h3@q+hHHc|="L)PEURK*J:>`0p3:P*9!<@0F^EOP9},QR3Frf@" RbE\ir/F="IRaetD~giL~N=+Z^mCo(Ay`"H'P~|7MK#4GlK#K+A(fx)exS.8myMBAQ", rc'8Ad% 2Uq="#:iC#;`MIy$'zY7{WhpU{-H)-kr2"uF;6>n^s7:+0{\", %g,%Cb:v}m"nSO8t:Jc.j8(M*~d="`(;:)j2dTI &LGa\jkhxa%Yo#"" Process "cmd.exe" (UID: 00000000-00012036) was launched with missing environment variables: "J`aZ, #LH- oqK/`,%nHmN*f$G[hwHERMESf-bN~F|+f, sDGy12S:Fo, vQ_2f|C7D3V%3< , Xvh~RS|fKb:, V%;qIr1edx3j{j" Process "reg.exe" (UID: 00000000-00012068) was launched with new environment variables: "NQu*KAcQpo/W!Y2wJ|[Mt}2s|E="_N+Rl}Q0TGCSnzy"J4^p/XA?3E2p7w$NS,d~{[CQiO,6Izt[rt(3Z$z@Ze)T=HYc*WvlNH&T3G) 1:WD]rP,47sx^((G`8*Z3Zqp'r^o" xIqRMxQkrka54^Uf*N$`!J|OVtE",)A9q1J`TZd9YMzGT-="PPK4Pw3}UYb'5L{lP;1'ck-8=&v:a}_`~nW", iRrTJyIqA/*ASWDs+ul="9CIK>.WVV1!:\WVj;aid5:nH", CP'm9l)*oq`a(giZz9h$V]+&j$?]i0OwKR="StjsRM4v+=(?1cfedl2.>6t?R", }="D9I'}b8@kmo3Ob+n!s$0yd^k<(_lyCux7*DfNQ"+r]h!=l`2c(HF(*nxI@G0m&ZV;bCwl~'JKu`Yq#[Ch/JE~l&zD{&Rc,", ig/nrU5L\6Zhi q-jG]@jt@8Yj#tCv_~ym="qfNZ/~sT/:T`2", aAdx\ 7ss`+{h"_G|uCF+Y:o;O[PFqe//&1k%L9="?-+EKt24"", Process "reg.exe" (UID: 00000000-00012068) was launched with missing environment variables: " ,GT0##R:b{*s~<'9e, I8F"*!D~(:*.Z.RCVn00(}++ht!EBPW\'G|N%Y&/xVO_p_lPz,, "Bv8K0U++j{X&^AacOjC6J$xKuyA-S+MKW^kt'DLlrvv~4?tha%.GHERMESfhCZKtbJ/Osc7S)0"%mK/z2.7'hYm!Wd|Tl\3i%-c3"9n1N58h3@q+hHHc| RbE\ir/F rc'8Ad% 2Uq %g %Cb:v}m"nSO8t:Jc.j8(M*~d"2c:T417,Spawned process "z.ug\"\n Heuristic match: \"anq.ws\"\n Heuristic match: \"n*1|?~x'u.vn\"\n Heuristic match: \"%e%v.ae\"\n Heuristic match: \"$x.cl\"\n Heuristic match: \"hv].vi\"\n Heuristic match: \"?7ez.mq\"\n Heuristic match: \"w^.gb\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"},{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"aESg'\" (Indicator: \"aes\"; Source: \"00000000-00003696.00000000.233574.55E50000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; File: \"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"},{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: cDNiW.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"},{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetTokenInformation\" which can \"Retrieves a specified type of information about an access token\" [Source: cDNiW.exe]\n Observed import api \"ImpersonateSelf\" which can \"Obtains an access token that impersonates the security context of the calling process\" [Source: cDNiW.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"NotifyIconGeneratedAumid_15348565561546929627.png\" has type \"data\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"},{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe\" has section name .text with entropy \"6.61441868823\"\n \"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe\" has section name .data with entropy \"6.2022010052\"\n \"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe\" has section name .reloc with entropy \"6.16055954587\"\n \"cDNiW.exe\" has section name .text with entropy \"6.44518453703\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"uj-@j.7\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"cDNiW.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"Your network has been penetrated.All files on each host in the network have been encrypted with a strong algorithm.Backups were either encrypted or deleted or backup disks were formatted.Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.We exclusively have decryption software for your situationNo decryption software is available in the public.DO NOT RESET OR SHUTDOWN - files may be damaged.DO NOT RENAME OR MOVE the encrypted and readme files.DO NOT DELETE readme files.This may lead to the impossibility of recovery of the certain files.To get info (decrypt your files) contact us atWayneEvenson@protonmail.comWayneEvenson@tutanota.comBTC wallet:14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hkRyukNo system is safe\" (Source: RyukReadMe.txt, Indicator: \"decrypt your files\")","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetVersionExW\n GetModuleFileNameA\n LoadLibraryA\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n FindFirstFileExA\n WriteFile\n FindNextFileA\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n CreateFileW\n IsDebuggerPresent\n GetTickCount\n ShellExecuteW\n OpenProcessToken\n CreateToolhelp32Snapshot\n VirtualAllocEx\n CreateRemoteThread\n WriteProcessMemory\n OpenProcess\n Process32FirstW\n Process32NextW\n GetModuleHandleA\n DeleteFileW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"},{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sample.bin\" (Offset: 100314)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"},{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"},{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create thread in the virtual address space of another process (API string)","description":"Observed api string:\"CreateRemoteThread\" [Source: 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin]","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write data into process memory (API string)","description":"Observed api string:\"WriteProcessMemory\" [Source: 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"FlsGetValue\" (Indicator: \"FlsGetValue\")\n \"FlsSetValue\" (Indicator: \"FlsSetValue\")\n \"InitializeCriticalSectionEx\" (Indicator: \"InitializeCriticalSection\")\n \"CorExitProcess\" (Indicator: \"ExitProcess\")\n \"LocaleNameToLCID\" (Indicator: \"LocaleNameToLCID\")\n \"IsWow64Process\" (Indicator: \"IsWow64Process\")\n \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\")\n \"WriteFile\" (Indicator: \"WriteFile\")\n \"GetModuleFileNameW\" (Indicator: \"GetModuleFileNameW\")\n \"CreateFileW\" (Indicator: \"CreateFileW\")\n \"GetVersionExW\" (Indicator: \"GetVersion\")\n \"LoadLibraryA\" (Indicator: \"LoadLibraryA\")\n \"CloseHandle\" (Indicator: \"CloseHandle\")\n \"GetWindowsDirectoryW\" (Indicator: \"GetWindow\")\n \"GetProcAddress\" (Indicator: \"GetProcAddress\")\n \"FreeLibrary\" (Indicator: \"FreeLibrary\")\n \"GetTickCount\" (Indicator: \"GetTickCount\")\n \"ShellExecuteW\" (Indicator: \"ShellExecuteW\")\n \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\")\n \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed api string:\"CreateToolhelp32Snapshot\" [Source: 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin]\n Observed api string:\"Process32NextW\" [Source: 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin]\n Observed api string:\"Process32FirstW\" [Source: 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges error: %u\" [Source: 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeDebugPrivilege which can Debug programs\"[Source: 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"\"stop Antivirus /y\" (Indicator: \"antivir\")\n \"stop McAfeeEngineService /y\" (Indicator: \"mcafee\")\n \"stop McAfeeFramework /y\" (Indicator: \"mcafee\")\n \"stop McAfeeFrameworkMcAfeeFramework /y\" (Indicator: \"mcafee\")\n \"stop McShield /y\" (Indicator: \"mcshield\")\n \"stop SAVAdminService /y\" (Indicator: \"avadmin\")\n \"stop SmcService /y\" (Indicator: \"smcservice\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"\"/IM zoolz.exe /F\" (Indicator: \"zoolz.exe\")\n \"/IM agntsvc.exe /F\" (Indicator: \"agntsvc.exe\")\n \"/IM dbeng50.exe /F\" (Indicator: \"dbeng50.exe\")\n \"/IM dbsnmp.exe /F\" (Indicator: \"dbsnmp.exe\")\n \"/IM encsvc.exe /F\" (Indicator: \"encsvc.exe\")\n \"/IM infopath.exe /F\" (Indicator: \"infopath.exe\")\n \"/IM mspub.exe /F\" (Indicator: \"mspub.exe\")\n \"/IM mydesktopqos.exe /F\" (Indicator: \"mydesktopqos.exe\")\n \"/IM mydesktopservice.exe /F\" (Indicator: \"mydesktopservice.exe\")\n \"/IM ocautoupds.exe /F\" (Indicator: \"ocautoupds.exe\")\n \"/IM ocomm.exe /F\" (Indicator: \"ocomm.exe\")\n \"/IM ocssd.exe /F\" (Indicator: \"ocssd.exe\")\n \"/IM onenote.exe /F\" (Indicator: \"onenote.exe\")\n \"/IM steam.exe /F\" (Indicator: \"steam.exe\")\n \"/IM synctime.exe /F\" (Indicator: \"synctime.exe\")\n \"/IM thebat.exe /F\" (Indicator: \"thebat.exe\")\n \"/IM thebat64.exe /F\" (Indicator: \"thebat64.exe\")\n \"/IM visio.exe /F\" (Indicator: \"visio.exe\")\n \"/IM xfssvccon.exe /F\" (Indicator: \"xfssvccon.exe\")\n \"/IM tmlisten.exe /F\" (Indicator: \"tmlisten.exe\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"61/71 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin\" has a section named \".gfids\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"61/71 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$2a","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PBDRP.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PBDRP.EXE\")\n \"PbDRp.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"PbDRp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"informative","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SVCHOS\"; Value: \"%PUBLIC%\\PbDRp.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"reg.exe\" wrote bytes \"4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000\" to virtual address \"0x76FE1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00013633-00002664-34508-31-01151D76\n cpuid at 00013857-00002860-37264-32-30005656","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PbDRp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"taskhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"PbDRp.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to create a remote thread (often used for process injection)","description":"CreateRemoteThread@KERNEL32.DLL at 00013857-00002860-37264-99-30002370","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-5","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to write to a remote process","description":"WriteProcessMemory@KERNEL32.DLL at 00013857-00002860-37264-99-30002370","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-34","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%PUBLIC%\\PbDRp.exe\", Handle: 392)\n \"PbDRp.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 320)\n \"cmd.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\reg.exe\", Handle: 84)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"taskhost.exe\" monitors \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Filter: 5; Subtree: 1)\n \"taskhost.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"dwm.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"conhost.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00013857-00002860-37264-102-30002090","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%PUBLIC%\\PbDRp.exe\" marked \"C:\\210.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"PbDRp.exe\" opened \"C:\\210.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"PbDRp.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"PbDRp.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"PbDRp.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$30","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Opens many files with write access (often indicator for full-system infection)","description":"\"taskhost.exe\" opens more than 500 files with write access","origin":"API Call","relevance":10,"id":"api-49","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"HKCU\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\"\n \"PbDRp.exe\" allocated memory in \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\"\n \"PbDRp.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_LOCALMACHINE_LOCKDOWN\"\n \"PbDRp.exe\" allocated memory in \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\4\"\n \"PbDRp.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\"\n \"PbDRp.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\WMR\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"taskhost.exe\" at 2018-8-19.00:28:36.932 (UID: 00014571-00001332)\n Injected into \"dwm.exe\" at 2018-8-19.00:28:37.382 (UID: 00014602-00001444)\n Injected into \"conhost.exe\" at 2018-8-19.00:28:37.693 (UID: 00014632-00001292)\n Injected into \"conhost.exe\" at 2018-8-19.00:28:38.003 (UID: 00014662-00002708)\n Injected into \"conhost.exe\" at 2018-8-19.00:28:38.294 (UID: 00014692-00003164)","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_ReadMe_.txt\" which has been seen in the context of ransomware (Indicator: README_.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"},{"report_type":"sandbox","report_id":"6399e4898dbf77342220538d"},{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"},{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]}],"intel_graph":{"map":{"File:00185ad496d82b3370e3bf98b7232299c8d2119b0601ae657ce43d662f1cc6e1":{"type":"File","value":"00185ad496d82b3370e3bf98b7232299c8d2119b0601ae657ce43d662f1cc6e1"},"File:04d4a7b3e0320fd57b3554852650744aab3a3ff7b315bedb6c518bd2d0006504":{"type":"File","value":"04d4a7b3e0320fd57b3554852650744aab3a3ff7b315bedb6c518bd2d0006504"},"File:056af89ec4f14e4f7c9be527e68338e37d2aa25e1a54790e49be70205285b35e":{"type":"File","value":"056af89ec4f14e4f7c9be527e68338e37d2aa25e1a54790e49be70205285b35e"},"File:0784a9ded176fd68c826912ddef3e02209455e4fc6a97834b9ffac39c8d51996":{"type":"File","value":"0784a9ded176fd68c826912ddef3e02209455e4fc6a97834b9ffac39c8d51996"},"File:0b4012c655781b45d50c4e2dade6cb125c355f4e10627de844b5b53994051d2a":{"type":"File","value":"0b4012c655781b45d50c4e2dade6cb125c355f4e10627de844b5b53994051d2a"},"File:0edfe91fd9c3269e45253c2e37f44ea747d4a665a404fbc206100b41981245f8":{"type":"File","value":"0edfe91fd9c3269e45253c2e37f44ea747d4a665a404fbc206100b41981245f8"},"File:125aabd628054556e9a232ff19aa7b283c20aa1d1377b0f70822d38763f4c6ed":{"type":"File","value":"125aabd628054556e9a232ff19aa7b283c20aa1d1377b0f70822d38763f4c6ed"},"File:195bccb17597a8e26b83b664018cf1f662c22bacddfcf3e0deda8a0616f475fe":{"type":"File","value":"195bccb17597a8e26b83b664018cf1f662c22bacddfcf3e0deda8a0616f475fe"},"File:1d8b7962d1c832c9af63184e0ee6680be2b7b23f0eb87069747422021b8cb6fe":{"type":"File","value":"1d8b7962d1c832c9af63184e0ee6680be2b7b23f0eb87069747422021b8cb6fe"},"File:1f63193786f2a14f5b7b7e1b7bae9a59ef621c3d8bee6048514d1f00da5e5337":{"type":"File","value":"1f63193786f2a14f5b7b7e1b7bae9a59ef621c3d8bee6048514d1f00da5e5337"},"File:21b91a9aedfb10be6e014ef997c0ba8f45037dfaa0e10a42295d6905a37c3e5c":{"type":"File","value":"21b91a9aedfb10be6e014ef997c0ba8f45037dfaa0e10a42295d6905a37c3e5c"},"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2":{"type":"File","value":"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Creates registry ASEP using reg.exe","File reported as ransomware by ClamAV antivirus","Writes to registry using reg.exe","confirmed malicious file","confirmed relationship with a Threat Ryuk"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:29e36edbd3a5412b45e60c4df92d9a4ddfbe9a58b28abb56ea63bb0c0e21eb0c":{"type":"File","value":"29e36edbd3a5412b45e60c4df92d9a4ddfbe9a58b28abb56ea63bb0c0e21eb0c"},"File:2ba58768af82615df153195dc0be3d59cc5d46b91cf7a938e1d6b80e7b9343de":{"type":"File","value":"2ba58768af82615df153195dc0be3d59cc5d46b91cf7a938e1d6b80e7b9343de"},"File:2f40623e6d483affebe735435db03184209f2495a40fcd762c3b45c0fc716601":{"type":"File","value":"2f40623e6d483affebe735435db03184209f2495a40fcd762c3b45c0fc716601"},"File:314031d7d3adceb48e23fd7f1a14cf87fed332217ea951a71e1b3ba2b374d146":{"type":"File","value":"314031d7d3adceb48e23fd7f1a14cf87fed332217ea951a71e1b3ba2b374d146"},"File:35b61ca58a848375fa26866a87af0bc964565c45147cf0fccd47ba4d5d2a515a":{"type":"File","value":"35b61ca58a848375fa26866a87af0bc964565c45147cf0fccd47ba4d5d2a515a"},"File:36b5e62ff13165b2e66884bd9252c42178430946827d96512b8d830d38ccc1aa":{"type":"File","value":"36b5e62ff13165b2e66884bd9252c42178430946827d96512b8d830d38ccc1aa"},"File:3717953bfa0b494f7063d5dbc2b5ccf561276a13f630c332dc0cc2e7bf185de7":{"type":"File","value":"3717953bfa0b494f7063d5dbc2b5ccf561276a13f630c332dc0cc2e7bf185de7"},"File:3ae8cb6130d7290957f1bbe74ddae4d445675b527375c8f384efa398a2abf24a":{"type":"File","value":"3ae8cb6130d7290957f1bbe74ddae4d445675b527375c8f384efa398a2abf24a"},"File:3bb77ea1fe9c9e1672650ffafa362f3eff6120ab6c9b5a8d90d4286094c0be17":{"type":"File","value":"3bb77ea1fe9c9e1672650ffafa362f3eff6120ab6c9b5a8d90d4286094c0be17"},"File:3dda4a34b0b036b087ecc7512848b5fd18b54f662a1038208e3217ede9835ca9":{"type":"File","value":"3dda4a34b0b036b087ecc7512848b5fd18b54f662a1038208e3217ede9835ca9"},"File:3ff71041d6449675b44605bb483eb5142f16ebd1b91dc9ca362282db399d5f15":{"type":"File","value":"3ff71041d6449675b44605bb483eb5142f16ebd1b91dc9ca362282db399d5f15"},"File:4305917d55c4e6f4033d6ca7ccbb3c5376fc5e09a6136757a02fe22d397fac05":{"type":"File","value":"4305917d55c4e6f4033d6ca7ccbb3c5376fc5e09a6136757a02fe22d397fac05"},"File:4519f3ecb16cbf0ced84df4e181e9e940727cf0af0965c9d894d6f5f07377c99":{"type":"File","value":"4519f3ecb16cbf0ced84df4e181e9e940727cf0af0965c9d894d6f5f07377c99"},"File:455af95f7088b609244452d89f6c5a02fcd5adce9d09de0b8df9fe61c091d219":{"type":"File","value":"455af95f7088b609244452d89f6c5a02fcd5adce9d09de0b8df9fe61c091d219"},"File:46c50cfbbce7ab7a2896f4900985e353d1575ec360fb836bb44d74803f6cd5cc":{"type":"File","value":"46c50cfbbce7ab7a2896f4900985e353d1575ec360fb836bb44d74803f6cd5cc"},"File:48082ed1dbf6fa077526366a0b52841802e152ede38c988cb9929dbb9b91de12":{"type":"File","value":"48082ed1dbf6fa077526366a0b52841802e152ede38c988cb9929dbb9b91de12"},"File:48bcf1162ac860003dd4648de5b51b797d3aff536a0a23f350747e9b67c71204":{"type":"File","value":"48bcf1162ac860003dd4648de5b51b797d3aff536a0a23f350747e9b67c71204"},"File:48d012ee691dd09563868032c0c85681450f77ec8540975a0be380906d3f1834":{"type":"File","value":"48d012ee691dd09563868032c0c85681450f77ec8540975a0be380906d3f1834"},"File:4b848862ceeaa315de9cf9e625a45cb2bb99dd2acee1e42e8913d3cd45a83929":{"type":"File","value":"4b848862ceeaa315de9cf9e625a45cb2bb99dd2acee1e42e8913d3cd45a83929"},"File:4b85bcc04c15ee541257f48790d4d1bdd927c0c3a1a1782696f0cc6bc8dd397d":{"type":"File","value":"4b85bcc04c15ee541257f48790d4d1bdd927c0c3a1a1782696f0cc6bc8dd397d"},"File:4bc5ede6499658addbc9511589c3a6f924c246398e9781f81b09ed360aa95697":{"type":"File","value":"4bc5ede6499658addbc9511589c3a6f924c246398e9781f81b09ed360aa95697"},"File:4dd071e3f47fd88f0aab7bf7f514c2536ab04bb27d92f4cc1ca153bbde3cfe09":{"type":"File","value":"4dd071e3f47fd88f0aab7bf7f514c2536ab04bb27d92f4cc1ca153bbde3cfe09"},"File:4f8616dfe7b127d4949aaec79467efae3b2bfe7a10c0807b103d58397cd0e2e4":{"type":"File","value":"4f8616dfe7b127d4949aaec79467efae3b2bfe7a10c0807b103d58397cd0e2e4"},"File:5ab7a6880e60ac5ec1a19cfd2a79536467ee539705ca60719230747f5b79742b":{"type":"File","value":"5ab7a6880e60ac5ec1a19cfd2a79536467ee539705ca60719230747f5b79742b"},"File:5d7ba72a703b43d56386c37dc7a0119197b083e806e196d9969b31e960a7a2c4":{"type":"File","value":"5d7ba72a703b43d56386c37dc7a0119197b083e806e196d9969b31e960a7a2c4"},"File:5e8d0f19e37db0163990c684be1d5f74b617a480424d9f69b50b5c96fa8bab4a":{"type":"File","value":"5e8d0f19e37db0163990c684be1d5f74b617a480424d9f69b50b5c96fa8bab4a"},"File:5f9439b7c7b3629b6d29d1a12bd2f055c7ca438d7d8d9bfbb07ff75f8329a591":{"type":"File","value":"5f9439b7c7b3629b6d29d1a12bd2f055c7ca438d7d8d9bfbb07ff75f8329a591"},"File:6075b966ed726ebd4ac8ec619cf6ab85c40ccbe1941d0655ca4d124720ae090d":{"type":"File","value":"6075b966ed726ebd4ac8ec619cf6ab85c40ccbe1941d0655ca4d124720ae090d"},"File:60c6ad6bd51115014eb9f8bc5e827dc2bf0922509dc777a4ab7acce6ddfa8e97":{"type":"File","value":"60c6ad6bd51115014eb9f8bc5e827dc2bf0922509dc777a4ab7acce6ddfa8e97"},"File:61e93113ee86026d2034784d571a942f84ba89f8287b5f5b9e8c501475e85539":{"type":"File","value":"61e93113ee86026d2034784d571a942f84ba89f8287b5f5b9e8c501475e85539"},"File:6225c88d2b33a49b5efa8a529857ea0ef13af3f16d844d64a9ecc18d852b8544":{"type":"File","value":"6225c88d2b33a49b5efa8a529857ea0ef13af3f16d844d64a9ecc18d852b8544"},"File:66b50afe79633d20c19480306ab280f76d2f627f74935f803470576fa47809f4":{"type":"File","value":"66b50afe79633d20c19480306ab280f76d2f627f74935f803470576fa47809f4"},"File:69d7cc4caa2d3b2824be93d2abbd2ae43d44349856f6c98342ab9bc4bbef6352":{"type":"File","value":"69d7cc4caa2d3b2824be93d2abbd2ae43d44349856f6c98342ab9bc4bbef6352"},"File:6d086986fd17dc04c8a07290f90b06c259f4d61aeedb0859c481528ab4f59f12":{"type":"File","value":"6d086986fd17dc04c8a07290f90b06c259f4d61aeedb0859c481528ab4f59f12"},"File:70849a5cd473c1a04d10de67baa64761627f3c850f8e35731e9bcddac7c3dac3":{"type":"File","value":"70849a5cd473c1a04d10de67baa64761627f3c850f8e35731e9bcddac7c3dac3"},"File:74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2":{"type":"File","value":"74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2"},"File:74c5f40e1488dfaa5b1c3c6db961aa8766edd9ff4abc633e1cf8bb63af4c1b56":{"type":"File","value":"74c5f40e1488dfaa5b1c3c6db961aa8766edd9ff4abc633e1cf8bb63af4c1b56"},"File:77b2d3bd5999e8ef3310f025796ea5efe92b1be9bc63251068ec3d432b6f97b2":{"type":"File","value":"77b2d3bd5999e8ef3310f025796ea5efe92b1be9bc63251068ec3d432b6f97b2"},"File:7c09c59919d79ba311bf399541e6c05771a8551f47f38932e1bfa92b9b02e658":{"type":"File","value":"7c09c59919d79ba311bf399541e6c05771a8551f47f38932e1bfa92b9b02e658"},"File:8096049aa23b5e05577b89102f55476aeccac36a0726f049943dee254ab73cc5":{"type":"File","value":"8096049aa23b5e05577b89102f55476aeccac36a0726f049943dee254ab73cc5"},"File:8104dc343f408e3ff276e33815fab37d0c7162ba343e3d3bfd02a4e0698d7531":{"type":"File","value":"8104dc343f408e3ff276e33815fab37d0c7162ba343e3d3bfd02a4e0698d7531"},"File:8787ce5f53bb3675c89c558736725fb81677fc7c0ec08b072f49877a7b85ad6f":{"type":"File","value":"8787ce5f53bb3675c89c558736725fb81677fc7c0ec08b072f49877a7b85ad6f"},"File:8b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d":{"type":"File","value":"8b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d"},"File:8f9c728d24ac7027b8ab397dda9b99af8399462cd2d133b8facdc18c7c0605b3":{"type":"File","value":"8f9c728d24ac7027b8ab397dda9b99af8399462cd2d133b8facdc18c7c0605b3"},"File:9232c2ffcde7bb30fb4aaf313df8ee7f74df9f7db9992289f1ed3fcb7e8e5128":{"type":"File","value":"9232c2ffcde7bb30fb4aaf313df8ee7f74df9f7db9992289f1ed3fcb7e8e5128"},"File:967e3657790c63024c44cb580d414eac1442f64e403549928fd7d2abe8fc8d09":{"type":"File","value":"967e3657790c63024c44cb580d414eac1442f64e403549928fd7d2abe8fc8d09"},"File:975f66470a6391578a4fb92aadb4cb582277e917d0af161af99a5bfef4f6a6cb":{"type":"File","value":"975f66470a6391578a4fb92aadb4cb582277e917d0af161af99a5bfef4f6a6cb"},"File:9e4b6ba3d47a0d3b4c430ff70842fea8b683ee27ca9de12b28b911c6024372c4":{"type":"File","value":"9e4b6ba3d47a0d3b4c430ff70842fea8b683ee27ca9de12b28b911c6024372c4"},"File:9f0bf689a7672ec4240f71203e65780b49f6489879493d5756a1848b6e797b31":{"type":"File","value":"9f0bf689a7672ec4240f71203e65780b49f6489879493d5756a1848b6e797b31"},"File:a35b29946e26fc8f51a5decbe2d5b01932f807e6e24214785da052f959425f99":{"type":"File","value":"a35b29946e26fc8f51a5decbe2d5b01932f807e6e24214785da052f959425f99"},"File:a40acf76d1b4ab8458603f58b408196b56db851169a5aa412e616ebdfc337ef2":{"type":"File","value":"a40acf76d1b4ab8458603f58b408196b56db851169a5aa412e616ebdfc337ef2"},"File:b69d80491552316066068ba5b840f87787f751f5f7b5f6a90aafeaa9061abf57":{"type":"File","value":"b69d80491552316066068ba5b840f87787f751f5f7b5f6a90aafeaa9061abf57"},"File:b6ef5851e728f1503256a9ef36856c80e78c36724965e3a578739e8540bd99c0":{"type":"File","value":"b6ef5851e728f1503256a9ef36856c80e78c36724965e3a578739e8540bd99c0"},"File:b70856f6b8d7023880d0bf778603b9d392744c3f4b6aa30339aeac74ee09fe10":{"type":"File","value":"b70856f6b8d7023880d0bf778603b9d392744c3f4b6aa30339aeac74ee09fe10"},"File:bb4a645b5c68334d4c4c1d62c04fce533f8732262562fdff80f18db09bc49606":{"type":"File","value":"bb4a645b5c68334d4c4c1d62c04fce533f8732262562fdff80f18db09bc49606"},"File:bca4438c3545c343e0ec08ac7e746be71c111c4a868f3a4d683a5240862bee21":{"type":"File","value":"bca4438c3545c343e0ec08ac7e746be71c111c4a868f3a4d683a5240862bee21"},"File:be187eef6ab3f273df8151c1bfae43bb7653ea59fc7d1d2497ca7f29b2a1b72c":{"type":"File","value":"be187eef6ab3f273df8151c1bfae43bb7653ea59fc7d1d2497ca7f29b2a1b72c"},"File:bfed098b7f199c2842df99f6051ee8628e18e161a9cccde72f87420db4d34ac3":{"type":"File","value":"bfed098b7f199c2842df99f6051ee8628e18e161a9cccde72f87420db4d34ac3"},"File:c31f4bd9be1117ac10b3234aa5a3afae26f9df03f050dca99d53c7d5e481cb3e":{"type":"File","value":"c31f4bd9be1117ac10b3234aa5a3afae26f9df03f050dca99d53c7d5e481cb3e"},"File:c4d642a4ce4b7a87675cf54a981a091d0b1150c20154b85f53841ca87f6e92fa":{"type":"File","value":"c4d642a4ce4b7a87675cf54a981a091d0b1150c20154b85f53841ca87f6e92fa"},"File:c5457a2a19697e990b705dfe083cebca045e9191dc2cc6084997cbdbdc1defdf":{"type":"File","value":"c5457a2a19697e990b705dfe083cebca045e9191dc2cc6084997cbdbdc1defdf"},"File:ca48e58f58b16057a822db9594da2b04d74f802931272e2bc6f71367287cc8d1":{"type":"File","value":"ca48e58f58b16057a822db9594da2b04d74f802931272e2bc6f71367287cc8d1"},"File:cea5cbda3ef6dc95c4097442740adeec7f473be11ddefc73308bbbe24af50779":{"type":"File","value":"cea5cbda3ef6dc95c4097442740adeec7f473be11ddefc73308bbbe24af50779"},"File:d343cfdac48caefe43be9d972fb259f10a94ebc8067b863fd9271fc35cbc5bc0":{"type":"File","value":"d343cfdac48caefe43be9d972fb259f10a94ebc8067b863fd9271fc35cbc5bc0"},"File:d5a043aa486bec0bf71838db0488aa7934ddd2c697a08ae888b51372385eeeab":{"type":"File","value":"d5a043aa486bec0bf71838db0488aa7934ddd2c697a08ae888b51372385eeeab"},"File:d6202ff9cd7011a9797570ea3aa76a0f88f2df1a8210c8db9b5d3fb5803389fa":{"type":"File","value":"d6202ff9cd7011a9797570ea3aa76a0f88f2df1a8210c8db9b5d3fb5803389fa"},"File:d9c334aeeba75336d53b22e312d4950eaac1aad932745f7eb407c3d5fd78e73b":{"type":"File","value":"d9c334aeeba75336d53b22e312d4950eaac1aad932745f7eb407c3d5fd78e73b"},"File:dc0ab9c9eb404f9f111053b0c74463c1bfc2622a7cc68b791ebb40fff892f0bb":{"type":"File","value":"dc0ab9c9eb404f9f111053b0c74463c1bfc2622a7cc68b791ebb40fff892f0bb"},"File:e294db6eab92103a88d4de3236ae4f7833bdac9dd68492c425a0fa9c8bcb497d":{"type":"File","value":"e294db6eab92103a88d4de3236ae4f7833bdac9dd68492c425a0fa9c8bcb497d"},"File:e329d4459c42bcbcfce6ab96681741793c65a2142d1b627392cb6a84d38fc5ec":{"type":"File","value":"e329d4459c42bcbcfce6ab96681741793c65a2142d1b627392cb6a84d38fc5ec"},"File:e4a9e63ce244cb340d53d1d675508ccf188dda99662a6f53bf22162c10e50043":{"type":"File","value":"e4a9e63ce244cb340d53d1d675508ccf188dda99662a6f53bf22162c10e50043"},"File:e56b4c7f75afbb837cf528492d8fefd00a318e7d2c9bf2b16c0a1c44bd8952fb":{"type":"File","value":"e56b4c7f75afbb837cf528492d8fefd00a318e7d2c9bf2b16c0a1c44bd8952fb"},"File:e6623f2a0ff2aa28f57bce011164664bcbb23424737a8e451aa37568d8661fe9":{"type":"File","value":"e6623f2a0ff2aa28f57bce011164664bcbb23424737a8e451aa37568d8661fe9"},"File:ef6ac20d9dcd2498e98e726b2308c929e7a8dd173d052f97c58222dae9d0dd27":{"type":"File","value":"ef6ac20d9dcd2498e98e726b2308c929e7a8dd173d052f97c58222dae9d0dd27"},"File:fb46de2afa14ba18904cdabd93a35c0f094b3e39ac7df828aecc8eef0146dfc4":{"type":"File","value":"fb46de2afa14ba18904cdabd93a35c0f094b3e39ac7df828aecc8eef0146dfc4"},"File:fe95f23e52c464aef87ba8743a415dffa4b3bfc73fedc6b483cdfe93cf835e50":{"type":"File","value":"fe95f23e52c464aef87ba8743a415dffa4b3bfc73fedc6b483cdfe93cf835e50"},"File:ffd955bdb86b5a2dc89aecacf390654e78cdec0d4629be0e15564cf7339bcfb3":{"type":"File","value":"ffd955bdb86b5a2dc89aecacf390654e78cdec0d4629be0e15564cf7339bcfb3"},"Threat:3e5a9a73b7ce7dd761daca2ecdcd4e8d55cdb52712ff7bd3085a3d45699cc327":{"type":"Threat","value":"Ryuk","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1543243266696444012","root":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Creates registry ASEP using reg.exe","File reported as ransomware by ClamAV antivirus","Writes to registry using reg.exe","confirmed malicious file","confirmed relationship with a Threat Ryuk"]}},{"id":"1543243255088544266","root":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"Threat:3e5a9a73b7ce7dd761daca2ecdcd4e8d55cdb52712ff7bd3085a3d45699cc327"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_files","root":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","edges":[{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:8b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:04d4a7b3e0320fd57b3554852650744aab3a3ff7b315bedb6c518bd2d0006504"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:4519f3ecb16cbf0ced84df4e181e9e940727cf0af0965c9d894d6f5f07377c99"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:00185ad496d82b3370e3bf98b7232299c8d2119b0601ae657ce43d662f1cc6e1"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:74c5f40e1488dfaa5b1c3c6db961aa8766edd9ff4abc633e1cf8bb63af4c1b56"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:cea5cbda3ef6dc95c4097442740adeec7f473be11ddefc73308bbbe24af50779"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:6075b966ed726ebd4ac8ec619cf6ab85c40ccbe1941d0655ca4d124720ae090d"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:1d8b7962d1c832c9af63184e0ee6680be2b7b23f0eb87069747422021b8cb6fe"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:9f0bf689a7672ec4240f71203e65780b49f6489879493d5756a1848b6e797b31"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:0b4012c655781b45d50c4e2dade6cb125c355f4e10627de844b5b53994051d2a"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:b6ef5851e728f1503256a9ef36856c80e78c36724965e3a578739e8540bd99c0"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:fb46de2afa14ba18904cdabd93a35c0f094b3e39ac7df828aecc8eef0146dfc4"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:3ff71041d6449675b44605bb483eb5142f16ebd1b91dc9ca362282db399d5f15"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:4b848862ceeaa315de9cf9e625a45cb2bb99dd2acee1e42e8913d3cd45a83929"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:70849a5cd473c1a04d10de67baa64761627f3c850f8e35731e9bcddac7c3dac3"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:9e4b6ba3d47a0d3b4c430ff70842fea8b683ee27ca9de12b28b911c6024372c4"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:0784a9ded176fd68c826912ddef3e02209455e4fc6a97834b9ffac39c8d51996"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:5f9439b7c7b3629b6d29d1a12bd2f055c7ca438d7d8d9bfbb07ff75f8329a591"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:c31f4bd9be1117ac10b3234aa5a3afae26f9df03f050dca99d53c7d5e481cb3e"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:48d012ee691dd09563868032c0c85681450f77ec8540975a0be380906d3f1834"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:7c09c59919d79ba311bf399541e6c05771a8551f47f38932e1bfa92b9b02e658"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:8f9c728d24ac7027b8ab397dda9b99af8399462cd2d133b8facdc18c7c0605b3"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:77b2d3bd5999e8ef3310f025796ea5efe92b1be9bc63251068ec3d432b6f97b2"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:6225c88d2b33a49b5efa8a529857ea0ef13af3f16d844d64a9ecc18d852b8544"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:1f63193786f2a14f5b7b7e1b7bae9a59ef621c3d8bee6048514d1f00da5e5337"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:21b91a9aedfb10be6e014ef997c0ba8f45037dfaa0e10a42295d6905a37c3e5c"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:3bb77ea1fe9c9e1672650ffafa362f3eff6120ab6c9b5a8d90d4286094c0be17"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:bfed098b7f199c2842df99f6051ee8628e18e161a9cccde72f87420db4d34ac3"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:48bcf1162ac860003dd4648de5b51b797d3aff536a0a23f350747e9b67c71204"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:d6202ff9cd7011a9797570ea3aa76a0f88f2df1a8210c8db9b5d3fb5803389fa"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:d9c334aeeba75336d53b22e312d4950eaac1aad932745f7eb407c3d5fd78e73b"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:056af89ec4f14e4f7c9be527e68338e37d2aa25e1a54790e49be70205285b35e"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:b69d80491552316066068ba5b840f87787f751f5f7b5f6a90aafeaa9061abf57"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:3dda4a34b0b036b087ecc7512848b5fd18b54f662a1038208e3217ede9835ca9"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:0edfe91fd9c3269e45253c2e37f44ea747d4a665a404fbc206100b41981245f8"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:e56b4c7f75afbb837cf528492d8fefd00a318e7d2c9bf2b16c0a1c44bd8952fb"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:ca48e58f58b16057a822db9594da2b04d74f802931272e2bc6f71367287cc8d1"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:69d7cc4caa2d3b2824be93d2abbd2ae43d44349856f6c98342ab9bc4bbef6352"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:e329d4459c42bcbcfce6ab96681741793c65a2142d1b627392cb6a84d38fc5ec"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:66b50afe79633d20c19480306ab280f76d2f627f74935f803470576fa47809f4"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:d5a043aa486bec0bf71838db0488aa7934ddd2c697a08ae888b51372385eeeab"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:46c50cfbbce7ab7a2896f4900985e353d1575ec360fb836bb44d74803f6cd5cc"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:8104dc343f408e3ff276e33815fab37d0c7162ba343e3d3bfd02a4e0698d7531"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:125aabd628054556e9a232ff19aa7b283c20aa1d1377b0f70822d38763f4c6ed"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:ffd955bdb86b5a2dc89aecacf390654e78cdec0d4629be0e15564cf7339bcfb3"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:2f40623e6d483affebe735435db03184209f2495a40fcd762c3b45c0fc716601"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:60c6ad6bd51115014eb9f8bc5e827dc2bf0922509dc777a4ab7acce6ddfa8e97"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:61e93113ee86026d2034784d571a942f84ba89f8287b5f5b9e8c501475e85539"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:455af95f7088b609244452d89f6c5a02fcd5adce9d09de0b8df9fe61c091d219"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:5d7ba72a703b43d56386c37dc7a0119197b083e806e196d9969b31e960a7a2c4"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:dc0ab9c9eb404f9f111053b0c74463c1bfc2622a7cc68b791ebb40fff892f0bb"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:36b5e62ff13165b2e66884bd9252c42178430946827d96512b8d830d38ccc1aa"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:314031d7d3adceb48e23fd7f1a14cf87fed332217ea951a71e1b3ba2b374d146"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:e4a9e63ce244cb340d53d1d675508ccf188dda99662a6f53bf22162c10e50043"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:3717953bfa0b494f7063d5dbc2b5ccf561276a13f630c332dc0cc2e7bf185de7"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:4bc5ede6499658addbc9511589c3a6f924c246398e9781f81b09ed360aa95697"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:b70856f6b8d7023880d0bf778603b9d392744c3f4b6aa30339aeac74ee09fe10"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:ef6ac20d9dcd2498e98e726b2308c929e7a8dd173d052f97c58222dae9d0dd27"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:4f8616dfe7b127d4949aaec79467efae3b2bfe7a10c0807b103d58397cd0e2e4"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:975f66470a6391578a4fb92aadb4cb582277e917d0af161af99a5bfef4f6a6cb"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:c5457a2a19697e990b705dfe083cebca045e9191dc2cc6084997cbdbdc1defdf"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:29e36edbd3a5412b45e60c4df92d9a4ddfbe9a58b28abb56ea63bb0c0e21eb0c"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:3ae8cb6130d7290957f1bbe74ddae4d445675b527375c8f384efa398a2abf24a"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:4b85bcc04c15ee541257f48790d4d1bdd927c0c3a1a1782696f0cc6bc8dd397d"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:4305917d55c4e6f4033d6ca7ccbb3c5376fc5e09a6136757a02fe22d397fac05"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:bca4438c3545c343e0ec08ac7e746be71c111c4a868f3a4d683a5240862bee21"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:e294db6eab92103a88d4de3236ae4f7833bdac9dd68492c425a0fa9c8bcb497d"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:a40acf76d1b4ab8458603f58b408196b56db851169a5aa412e616ebdfc337ef2"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:967e3657790c63024c44cb580d414eac1442f64e403549928fd7d2abe8fc8d09"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:35b61ca58a848375fa26866a87af0bc964565c45147cf0fccd47ba4d5d2a515a"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:4dd071e3f47fd88f0aab7bf7f514c2536ab04bb27d92f4cc1ca153bbde3cfe09"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:195bccb17597a8e26b83b664018cf1f662c22bacddfcf3e0deda8a0616f475fe"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:fe95f23e52c464aef87ba8743a415dffa4b3bfc73fedc6b483cdfe93cf835e50"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:48082ed1dbf6fa077526366a0b52841802e152ede38c988cb9929dbb9b91de12"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:bb4a645b5c68334d4c4c1d62c04fce533f8732262562fdff80f18db09bc49606"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:6d086986fd17dc04c8a07290f90b06c259f4d61aeedb0859c481528ab4f59f12"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:a35b29946e26fc8f51a5decbe2d5b01932f807e6e24214785da052f959425f99"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:d343cfdac48caefe43be9d972fb259f10a94ebc8067b863fd9271fc35cbc5bc0"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:9232c2ffcde7bb30fb4aaf313df8ee7f74df9f7db9992289f1ed3fcb7e8e5128"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:8787ce5f53bb3675c89c558736725fb81677fc7c0ec08b072f49877a7b85ad6f"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:2ba58768af82615df153195dc0be3d59cc5d46b91cf7a938e1d6b80e7b9343de"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:c4d642a4ce4b7a87675cf54a981a091d0b1150c20154b85f53841ca87f6e92fa"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:5e8d0f19e37db0163990c684be1d5f74b617a480424d9f69b50b5c96fa8bab4a"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:be187eef6ab3f273df8151c1bfae43bb7653ea59fc7d1d2497ca7f29b2a1b72c"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:e6623f2a0ff2aa28f57bce011164664bcbb23424737a8e451aa37568d8661fe9"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:8096049aa23b5e05577b89102f55476aeccac36a0726f049943dee254ab73cc5"},{"edge_kind":"extracted","from_key":"File:23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","to_key":"File:5ab7a6880e60ac5ec1a19cfd2a79536467ee539705ca60719230747f5b79742b"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":66,"dropped_files_count":0,"extracted_files_count":88,"files_written_count":669,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","filecoder","genkryptik","jabaxsta","kryptik","ransomware","ryuk","stealer","wizardspider","banker","emotet","wanacrypt0r","wannacry","wcry"],"sample_flags":["Extracted Files","Sample Crashed","User Comment","Multi-Process","Sample not shared"],"sandbox_reports":[{"id":"67b894f2f7845e982908cb40","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"ryuk.bin","analysis_start_time":"2025-02-21T15:00:03+00:00","indicators_count":{"informative":70,"suspicious":18,"malicious":8},"tags":["Multi-Process","User Comment"],"is_in_unified_schema":true},{"id":"6703e8e460f02fadc803c796","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe","analysis_start_time":"2024-10-07T13:57:57+00:00","indicators_count":{"informative":66,"suspicious":15,"malicious":2},"tags":["Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"6399e4898dbf77342220538d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.Ryuk","submit_name":"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin","analysis_start_time":"2022-12-14T14:58:18+00:00","indicators_count":{"informative":18,"suspicious":5,"malicious":6},"tags":["Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"6399e488baac3935b57ddc99","environment_id":200,"environment_description":"Android Static Analysis","state":"ERROR","error_type":"File \"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin\" was detected as \"exe\", this format is not supported on ANDROID","verdict":"undetected","submit_name":"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin","analysis_start_time":"2022-12-14T14:58:16+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"6399e4861bd9a321674adccc","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.Ryuk","submit_name":"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.bin","analysis_start_time":"2022-12-14T14:58:15+00:00","indicators_count":{"informative":28,"suspicious":14,"malicious":10},"tags":["Multi-Process","Extracted Files","Sample not shared","User Comment"],"is_in_unified_schema":true},{"id":"5c33329d7ca3e12d21363a77","environment_id":120,"environment_description":"Windows 7 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DSM:TIMED-OUT)","verdict":"undetected","threat_score":98,"malware_family":"Trojan.Ransom.Ryuk","submit_name":"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","analysis_start_time":"2020-02-17T00:53:50+00:00","indicators_count":{"informative":5,"suspicious":4,"malicious":5},"is_in_unified_schema":false},{"id":"5b78ac487ca3e1394667d414","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor","submit_name":"210.exe","analysis_start_time":"2018-08-19T00:27:23+00:00","indicators_count":{"informative":19,"suspicious":21,"malicious":11},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}],"processes":[{"pid":2664,"ppid":0,"name":"210.exe","command_line":"","sha256":"23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2","normalized_path":"C:\\210.exe","uid":"00013633-00002664","icon":"$31"},{"pid":2860,"ppid":2664,"name":"PbDRp.exe","command_line":"C:\\210.exe","sha256":"5d92914acdfb551c237866cc4cce6c80aeeeb695e52beecd2613694302c62271","normalized_path":"%PUBLIC%\\PbDRp.exe","parent_uid":"00013633-00002664","uid":"00013857-00002860"},{"pid":2056,"ppid":2860,"name":"cmd.exe","command_line":"/C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"svchos\" /t REG_SZ /d \"%PUBLIC%\\PbDRp.exe\" /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013857-00002860","uid":"00014555-00002056"},{"pid":4016,"ppid":2056,"name":"reg.exe","command_line":"REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"svchos\" /t REG_SZ /d \"%PUBLIC%\\PbDRp.exe\" /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00014555-00002056","uid":"00014577-00004016"},{"pid":1332,"ppid":2860,"name":"taskhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\taskhost.exe","parent_uid":"00013857-00002860","uid":"00014571-00001332"},{"pid":1444,"ppid":2860,"name":"dwm.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\dwm.exe","parent_uid":"00013857-00002860","uid":"00014602-00001444"},{"pid":1292,"ppid":2860,"name":"conhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00013857-00002860","uid":"00014632-00001292"},{"pid":2708,"ppid":2860,"name":"conhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00013857-00002860","uid":"00014662-00002708"},{"pid":3164,"ppid":2860,"name":"conhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00013857-00002860","uid":"00014692-00003164"}],"all_imported_dlls":["api-ms-win-core-synch-l1-2-0.dll","VxSSL32.dll","GROOVEEX.DLL","version.dll","devobj.dll","wow64cpu.dll","user32.dll","ATL90.dll","secur32.dll","msvcrt.dll","msvcp90.dll","cryptsp.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","normaliz.dll","iertutil.dll","setupapi.dll","uxtheme.dll","KernelBase.dll","shlwapi.dll","lpk.dll","imm32.dll","urlmon.dll","winbrand.dll","rpcrt4.dll","comctl32.dll","ntmarta.dll","userenv.dll","wow64.dll","sechost.dll","propsys.dll","apphelp.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","rpcss.dll","advapi32.dll","cryptbase.dll","ws2_32.dll","msvcr90.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","cfgmgr32.dll","msctf.dll","ole32.dll","clbcatq.dll","rsaenh.dll","VxSSL64.dll","wow64win.dll","kernel32.dll","shell32.dll","gdi32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","oleaut32.dll","Wldap32.dll","profapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","sspicli.dll","wininet.dll","fltLib.dll","nsi.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","ntdll.dll","usp10.dll","winnsi.dll","crypt32.dll","mpr.dll","msasn1.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"cDNiW.exe","sha256":"8b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"window.bat","sha256":"04d4a7b3e0320fd57b3554852650744aab3a3ff7b315bedb6c518bd2d0006504","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"OFFICE.ODF","sha256":"4519f3ecb16cbf0ced84df4e181e9e940727cf0af0965c9d894d6f5f07377c99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"qmgr.db","sha256":"00185ad496d82b3370e3bf98b7232299c8d2119b0601ae657ce43d662f1cc6e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"edb.log","sha256":"74c5f40e1488dfaa5b1c3c6db961aa8766edd9ff4abc633e1cf8bb63af4c1b56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"vxaction.log","sha256":"cea5cbda3ef6dc95c4097442740adeec7f473be11ddefc73308bbbe24af50779","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"qmgr.jfm","sha256":"6075b966ed726ebd4ac8ec619cf6ab85c40ccbe1941d0655ca4d124720ae090d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"settings.dat.LOG1","sha256":"1d8b7962d1c832c9af63184e0ee6680be2b7b23f0eb87069747422021b8cb6fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"settings.dat","sha256":"9f0bf689a7672ec4240f71203e65780b49f6489879493d5756a1848b6e797b31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"NotifyIconGeneratedAumid_15348565561546929627.png","sha256":"0b4012c655781b45d50c4e2dade6cb125c355f4e10627de844b5b53994051d2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"RyukReadMe.txt","sha256":"74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"08e575673cce10c72090304839888e02_fec973c0-c782-43a8-854c-f9f48d935e0d","sha256":"b6ef5851e728f1503256a9ef36856c80e78c36724965e3a578739e8540bd99c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6703e8e460f02fadc803c796"}]},{"name":"fullscreen-exit.svg","sha256":"fb46de2afa14ba18904cdabd93a35c0f094b3e39ac7df828aecc8eef0146dfc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"PlayStore_icon.svg","sha256":"3ff71041d6449675b44605bb483eb5142f16ebd1b91dc9ca362282db399d5f15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"vi_get.svg","sha256":"4b848862ceeaa315de9cf9e625a45cb2bb99dd2acee1e42e8913d3cd45a83929","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"Download_on_the_App_Store_Badge_fr_135x40.svg","sha256":"70849a5cd473c1a04d10de67baa64761627f3c850f8e35731e9bcddac7c3dac3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"Download_on_the_App_Store_Badge_da_135x40.svg","sha256":"9e4b6ba3d47a0d3b4c430ff70842fea8b683ee27ca9de12b28b911c6024372c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"OfficeMUISet.msi","sha256":"0784a9ded176fd68c826912ddef3e02209455e4fc6a97834b9ffac39c8d51996","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"notepad.vbs","sha256":"5f9439b7c7b3629b6d29d1a12bd2f055c7ca438d7d8d9bfbb07ff75f8329a591","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"ko_get.svg","sha256":"c31f4bd9be1117ac10b3234aa5a3afae26f9df03f050dca99d53c7d5e481cb3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"tr_get.svg","sha256":"48d012ee691dd09563868032c0c85681450f77ec8540975a0be380906d3f1834","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"cs_get.svg","sha256":"7c09c59919d79ba311bf399541e6c05771a8551f47f38932e1bfa92b9b02e658","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"ru_get.svg","sha256":"8f9c728d24ac7027b8ab397dda9b99af8399462cd2d133b8facdc18c7c0605b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"AppStore_icon.svg","sha256":"77b2d3bd5999e8ef3310f025796ea5efe92b1be9bc63251068ec3d432b6f97b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"fullscreen-exit-hover.svg","sha256":"6225c88d2b33a49b5efa8a529857ea0ef13af3f16d844d64a9ecc18d852b8544","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"ShellUI.MST","sha256":"1f63193786f2a14f5b7b7e1b7bae9a59ef621c3d8bee6048514d1f00da5e5337","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"th_get.svg","sha256":"21b91a9aedfb10be6e014ef997c0ba8f45037dfaa0e10a42295d6905a37c3e5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"help.svg","sha256":"3bb77ea1fe9c9e1672650ffafa362f3eff6120ab6c9b5a8d90d4286094c0be17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"Proof.msi","sha256":"bfed098b7f199c2842df99f6051ee8628e18e161a9cccde72f87420db4d34ac3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"GrooveMUI.msi","sha256":"48bcf1162ac860003dd4648de5b51b797d3aff536a0a23f350747e9b67c71204","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"_Excel3.xls","sha256":"d6202ff9cd7011a9797570ea3aa76a0f88f2df1a8210c8db9b5d3fb5803389fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"JSByteCodeWin.bin","sha256":"d9c334aeeba75336d53b22e312d4950eaac1aad932745f7eb407c3d5fd78e73b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"PowerPointMUI.msi","sha256":"056af89ec4f14e4f7c9be527e68338e37d2aa25e1a54790e49be70205285b35e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"InfoPathMUI.msi","sha256":"b69d80491552316066068ba5b840f87787f751f5f7b5f6a90aafeaa9061abf57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"setup.chm","sha256":"3dda4a34b0b036b087ecc7512848b5fd18b54f662a1038208e3217ede9835ca9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"OneNoteMUI.msi","sha256":"0edfe91fd9c3269e45253c2e37f44ea747d4a665a404fbc206100b41981245f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"Test.doc","sha256":"e56b4c7f75afbb837cf528492d8fefd00a318e7d2c9bf2b16c0a1c44bd8952fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"ExcelMUI.msi","sha256":"ca48e58f58b16057a822db9594da2b04d74f802931272e2bc6f71367287cc8d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6399e4861bd9a321674adccc"}]},{"name":"08e575673cce10c72090304839888e02_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"69d7cc4caa2d3b2824be93d2abbd2ae43d44349856f6c98342ab9bc4bbef6352","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"cef.pak","sha256":"e329d4459c42bcbcfce6ab96681741793c65a2142d1b627392cb6a84d38fc5ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Adobe.Reader.Dependencies.manifest","sha256":"66b50afe79633d20c19480306ab280f76d2f627f74935f803470576fa47809f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AdobeID.pdf","sha256":"d5a043aa486bec0bf71838db0488aa7934ddd2c697a08ae888b51372385eeeab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"DefaultID.pdf","sha256":"46c50cfbbce7ab7a2896f4900985e353d1575ec360fb836bb44d74803f6cd5cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AdobeCollabSync.DEU","sha256":"8104dc343f408e3ff276e33815fab37d0c7162ba343e3d3bfd02a4e0698d7531","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Annots.DEU","sha256":"125aabd628054556e9a232ff19aa7b283c20aa1d1377b0f70822d38763f4c6ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Checkers.DEU","sha256":"ffd955bdb86b5a2dc89aecacf390654e78cdec0d4629be0e15564cf7339bcfb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"DEXShare.spi","sha256":"2f40623e6d483affebe735435db03184209f2495a40fcd762c3b45c0fc716601","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"create_form.gif","sha256":"60c6ad6bd51115014eb9f8bc5e827dc2bf0922509dc777a4ab7acce6ddfa8e97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"2d.x3d","sha256":"61e93113ee86026d2034784d571a942f84ba89f8287b5f5b9e8c501475e85539","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"adobepdf.xdc","sha256":"455af95f7088b609244452d89f6c5a02fcd5adce9d09de0b8df9fe61c091d219","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"CENTEURO.TXT","sha256":"5d7ba72a703b43d56386c37dc7a0119197b083e806e196d9969b31e960a7a2c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"CP1251.TXT","sha256":"dc0ab9c9eb404f9f111053b0c74463c1bfc2622a7cc68b791ebb40fff892f0bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"CP1254.TXT","sha256":"36b5e62ff13165b2e66884bd9252c42178430946827d96512b8d830d38ccc1aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"CP1258.TXT","sha256":"314031d7d3adceb48e23fd7f1a14cf87fed332217ea951a71e1b3ba2b374d146","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AutoIt_Main_v10_256x256_RGB-A.ico","sha256":"e4a9e63ce244cb340d53d1d675508ccf188dda99662a6f53bf22162c10e50043","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AutoIt_Main_v9_48x48_256.ico","sha256":"3717953bfa0b494f7063d5dbc2b5ccf561276a13f630c332dc0cc2e7bf185de7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AutoIt_Main_v9_48x48_RGB-A.ico","sha256":"4bc5ede6499658addbc9511589c3a6f924c246398e9781f81b09ed360aa95697","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AutoIt_Old2.ico","sha256":"b70856f6b8d7023880d0bf778603b9d392744c3f4b6aa30339aeac74ee09fe10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AutoItX.chm","sha256":"ef6ac20d9dcd2498e98e726b2308c929e7a8dd173d052f97c58222dae9d0dd27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"calculator.vbs","sha256":"4f8616dfe7b127d4949aaec79467efae3b2bfe7a10c0807b103d58397cd0e2e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"_Excel4.xls","sha256":"975f66470a6391578a4fb92aadb4cb582277e917d0af161af99a5bfef4f6a6cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"BazisVirtualCDBus.inf","sha256":"c5457a2a19697e990b705dfe083cebca045e9191dc2cc6084997cbdbdc1defdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"ARCTIC.INF","sha256":"29e36edbd3a5412b45e60c4df92d9a4ddfbe9a58b28abb56ea63bb0c0e21eb0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"CANYON.INF","sha256":"3ae8cb6130d7290957f1bbe74ddae4d445675b527375c8f384efa398a2abf24a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"6SZfLTu9z.doc","sha256":"4b85bcc04c15ee541257f48790d4d1bdd927c0c3a1a1782696f0cc6bc8dd397d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"BLUEPRNT.INF","sha256":"4305917d55c4e6f4033d6ca7ccbb3c5376fc5e09a6136757a02fe22d397fac05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AXIS.INF","sha256":"bca4438c3545c343e0ec08ac7e746be71c111c4a868f3a4d683a5240862bee21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AcroRead.msi","sha256":"e294db6eab92103a88d4de3236ae4f7833bdac9dd68492c425a0fa9c8bcb497d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"0zIG0D.doc","sha256":"a40acf76d1b4ab8458603f58b408196b56db851169a5aa412e616ebdfc337ef2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"charsets.jar","sha256":"967e3657790c63024c44cb580d414eac1442f64e403549928fd7d2abe8fc8d09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"bazisvirtualcdbus.cat","sha256":"35b61ca58a848375fa26866a87af0bc964565c45147cf0fccd47ba4d5d2a515a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"DEEPBLUE.INF","sha256":"4dd071e3f47fd88f0aab7bf7f514c2536ab04bb27d92f4cc1ca153bbde3cfe09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"access-bridge.jar","sha256":"195bccb17597a8e26b83b664018cf1f662c22bacddfcf3e0deda8a0616f475fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"fe95f23e52c464aef87ba8743a415dffa4b3bfc73fedc6b483cdfe93cf835e50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"CONCRETE.INF","sha256":"48082ed1dbf6fa077526366a0b52841802e152ede38c988cb9929dbb9b91de12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AFTRNOON.INF","sha256":"bb4a645b5c68334d4c4c1d62c04fce533f8732262562fdff80f18db09bc49606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"ApothecaryMergeLetter.dotx","sha256":"6d086986fd17dc04c8a07290f90b06c259f4d61aeedb0859c481528ab4f59f12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AdjacencyLetter.dotx","sha256":"a35b29946e26fc8f51a5decbe2d5b01932f807e6e24214785da052f959425f99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AdjacencyMergeLetter.dotx","sha256":"d343cfdac48caefe43be9d972fb259f10a94ebc8067b863fd9271fc35cbc5bc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"BloodPressureTracker.xltx","sha256":"9232c2ffcde7bb30fb4aaf313df8ee7f74df9f7db9992289f1ed3fcb7e8e5128","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"ContemporaryPhotoAlbum.potx","sha256":"8787ce5f53bb3675c89c558736725fb81677fc7c0ec08b072f49877a7b85ad6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"ApothecaryNewsletter.dotx","sha256":"2ba58768af82615df153195dc0be3d59cc5d46b91cf7a938e1d6b80e7b9343de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"ATPVBAEN.XLAM","sha256":"c4d642a4ce4b7a87675cf54a981a091d0b1150c20154b85f53841ca87f6e92fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"ApothecaryLetter.dotx","sha256":"5e8d0f19e37db0163990c684be1d5f74b617a480424d9f69b50b5c96fa8bab4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"AdjacencyResume.dotx","sha256":"be187eef6ab3f273df8151c1bfae43bb7653ea59fc7d1d2497ca7f29b2a1b72c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Building Blocks.dotx","sha256":"e6623f2a0ff2aa28f57bce011164664bcbb23424737a8e451aa37568d8661fe9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Classic.dotx","sha256":"8096049aa23b5e05577b89102f55476aeccac36a0726f049943dee254ab73cc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Built-In Building Blocks.dotx","sha256":"5ab7a6880e60ac5ec1a19cfd2a79536467ee539705ca60719230747f5b79742b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"}]},{"path":"%PUBLIC%\\PbDRp.exe","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%WINDIR%\\System32\\reg.exe","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%WINDIR%\\System32\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PUBLIC%\\sys","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\08e575673cce10c72090304839888e02_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\08e575673cce10c72090304839888e02_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\Users\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\config.sys","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StdWW.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordLR.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OnoteLR.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeLR.cab","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\PerfLogs\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\PerfLogs\\Admin\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\ShellUI.MST","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\setup.chm","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\pss10r.chm","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.msi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Esl\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Liesmich.htm","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\cef.pak","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Adobe.Reader.Dependencies.manifest","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\nppdf32.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\nppdf32.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.sig","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\JSByteCodeWin.bin","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\license.html","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\license.html","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\accessibility.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\ReadOutLoud.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Acroform.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Multimedia.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\eBook.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\DVA.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\DigSig.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Checkers.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\BRdlang32.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\AdobeCollabSync.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\makeaccessible.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\IA32.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Escript.deu","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Annots.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\SendMail.deu","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Search.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\SaveAsRTF.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\reflow.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\RdLang32.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\pddom.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\Files.asfx","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Spelling.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\updater.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\PDFSigQFormalRep.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Weblink.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Accessibility.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\QRCode.pmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\DataMatrix.pmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annots.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Checkers.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\MCIMPP.mpp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.DEU","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\QuickTime.mpp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\DigSig.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Updater.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\DVA.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\MakeAccessible.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\SendMail.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Search.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\SaveAsRTF.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\reflow.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\ReadOutLoud.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\PDDom.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\EScript.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\weblink.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\eBook.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Spelling.api","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\drvDX9.x3d","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\3difr.x3d","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\prc\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\2d.x3d","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\drvSOFT.x3d","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\prc\\MyriadCAD.otf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\prcr.x3d","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\tesselate.x3d","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\pmd.cer","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\RTC.der","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\DEXShare.spi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\files.acx","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\Services.cfg","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\reviews_sent.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\warning.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\create_form.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\add_reviewer.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\email_all.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\end_review.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\ended_review_or_form.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\distribute_form.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\reviewers.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\main.css","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\bl.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\info.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\form_responses.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\forms_super.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\forms_received.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\forms_distributed.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\reviews_joined.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\pdf.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\open_original_form.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\br.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\review_shared.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\review_same_reviewers.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\review_email.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\review_browser.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\reviews_super.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\rss.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\submission_history.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\server_issue.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\server_lg.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\tl.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\trash.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\tr.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\stop_collection_data.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\turnOnNotificationInTray.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\turnOffNotificationInTray.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\server_ok.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\ReadMe.htm","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\Identity-H","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\Identity-V","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\ENUtxt.pdf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MyriadPro-Bold.otf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MyriadPro-Regular.otf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\CourierStd-Oblique.otf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\CourierStd-BoldOblique.otf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\CourierStd-Bold.otf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MyriadPro-It.otf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MyriadPro-BoldIt.otf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\CourierStd.otf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\AdobePiStd.otf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\SY______.PFM","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\zx______.pfm","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\zy______.pfm","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\SY______.PFB","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\ZX______.PFB","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\ZY______.PFB","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\SaslPrep\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\SaslPrep\\SaslPrepProfile_norm_bidi.spp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\ICU\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\ICU\\icudt26l.dat","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Setup Files\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Setup Files\\{AC76BA86-7AD7-1031-7B44-AB0000000001}\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Application Verifier\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Application Verifier\\REDIST.TXT","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Application Verifier\\vrfauto.h","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\Application Verifier\\vrfauto.idl","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Au3Check.dat","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\AutoIt_Main_v10_48x48_256.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\AutoIt_Main_v10_48x48_RGB-A.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\AutoIt_Main_v9_48x48_256.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\AutoIt_Main_v9_48x48_RGB-A.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\AutoIt_Old1.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\AutoIt_Main_v10_256x256_RGB-A.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\AutoIt_Old2.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\AutoIt_Old3.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\AutoIt_Old4.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP01.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP02.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP03.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP04.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP05.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP10.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP11.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP09.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP08.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP06.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP07.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\SETUP12.ICO","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoIt v3 Website.url","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoIt.chm","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\AutoItX.chm","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\AutoItX3.Assembly.xml","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\AutoItX3.psd1","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\AutoItX\\AutoItX.cpp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\AutoItX\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\AutoItX\\AutoItX.vcxproj","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\AutoItX\\AutoItX.vcxproj.filters","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\AutoItX.sln","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript\\notepad.vbs","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript\\calculator.vbs","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\calculator.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\WscriptFilesys.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\Worksheet.xls","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\EventTest-WMI.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\EventTest-SAPI.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\AutoItX-test.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\ExcelAutomationTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\FileSearchTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\ExcelFastTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\ExcelDataTest.AU3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\ErrorEventTest-WMI.AU3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\getHTMLsource.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\ExcelGetObjTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\ExcelFileTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\winntgroups.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\RemoteObjCreateTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\ErrorEventTest-ADSI.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\ShellStopStartServiceTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\Scriptomatic.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\RegExpTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\Instance-of-IE-test.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\WmiGetStringValue.AU3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\wmiForInTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\WmiDiskTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\Wmi-terminate.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\EventTest-IE6.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\WordTest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\wmiexample.AU3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\wscriptnetwork.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\wscriptshelltest.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\count-do.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\count-for.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\count-while.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\functions.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\AlphaBlend.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\BMPToJPG.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Clock.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\contextmenu.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\dice.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\encrypt.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\enumicons.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\imagebutton.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Emboss.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Images\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\menu.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\msgboxwizard.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Rotate.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\setlabel.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Images\\Blue.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Images\\Green.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Images\\Red.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Images\\Button.png","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Slicer.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\_NamedPipes_Client.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Zoom.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\treeview.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\sysinfo.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\ShowPNG.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\_NamedPipes_Server.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\logo4.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\merlin.gif","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\mslogo.jpg","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\msoobe.jpg","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\sampleAVI.avi","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\SampleControls.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Simple\\child.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Simple\\msgbox_onevent.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Simple\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Simple\\simplecalc.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Simple\\msgbox_messageloop.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Simple\\editbox.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Torus.png","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\@OSLang.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Abs.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ASin[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ASin.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\AdlibRegister.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\AutoItSetOption.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ATan[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ATan.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ACos.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ACos[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\AutoItWinSetTitle[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\AutoItWinSetTitle.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\AutoItWinGetTitle.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\BitAND.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\AscW.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\BinaryLen.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Binary.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Beep.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\BinaryToString.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\BinaryMid.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Asc.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\AdlibUnRegister.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\BlockInput.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\BitXOR.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\BitShift.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\BitRotate.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\BitOR.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\BitNOT.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Break.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Booleans.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Call.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Assign.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\CDTray.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Ceiling.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Chr.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ConsoleRead.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlCommand.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlClick.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ContinueLoop.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlFocus.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlEnable.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlDisable.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ClipGet.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\comments-start.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlGetPos.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlGetHandle.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlGetFocus.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ClipPut.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ContinueCase.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlListView.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlHide.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlGetText.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ConsoleWrite[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlSetText.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlSend.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlMove.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ConsoleWriteError.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Cos.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlTreeView.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ControlShow.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ChrW.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Dec.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ConsoleWrite.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Default.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Dim.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Dim[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DirCopy.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DirCreate.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DirGetSize.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DirMove.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DirRemove.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllCall.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllCallAddress.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllCallbackFree.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllCallbackGetPtr.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllCallbackRegister.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllCall[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllCall[3].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllClose.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllOpen.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllStructCreate.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllStructGetData.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllStructGetPtr.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllStructGetPtr[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllStructGetSize.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DllStructSetData.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Do.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveGetDrive.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveGetFileSystem.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveGetLabel.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveGetSerial.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveGetType.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveMapAdd.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveMapDel.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveMapGet.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveSetLabel.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveSpaceFree.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveSpaceTotal.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\DriveStatus.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Enum.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Enum[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Eval[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Eval.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Execute.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Exp.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Exit[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\EnvSet.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ExitLoop.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Exit.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\EnvGet.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\EnvUpdate.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Airplane.wav","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Authentication.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\AutoIt.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Flag.emf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Compass.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\dinosaur.ani","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Exclamation.png","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Hatch.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Arrow.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\horse.ani","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Lens.cur","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Mice0.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Mice1.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Mice2.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Mice3.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Mice5.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Mice6.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Mice4.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\_Excel.jpg","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\_Excel1.xls","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Pen.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\_Excel1.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\NVIDIA.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Test2.doc","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Test.doc","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Soccer.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\WMDebug.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Tech.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Script.ico","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\SF Square Head Bold.ttf","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Silverlight.png","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Pattern.bmp","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\Screenshot.png","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\_Excel2.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\_Excel2.xls","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\_Excel3.xls","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\_Excel4.xls","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileChangeDir.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileClose.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileCopy.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileCreateNTFSLink.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileCreateShortcut.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileDelete.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileExists.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileFindFirstFile.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileFindNextFile.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileFlush.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetAttrib.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetAttrib[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetEncoding.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetAttrib[3].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetLongName.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetPos.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetShortcut.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetShortName.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetSize.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetTime.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileGetVersion.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileInstall.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileReadLine.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileRead.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileOpenDialog.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileSaveDialog.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileRecycleEmpty.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileMove[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileSetAttrib.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileSelectFolder.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileOpenDialog[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileSetTime.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileSetPos.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileMove.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileWriteLine.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileWrite.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileOpen[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileRecycle.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\For.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Floor.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FuncName.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Func.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FtpSetProxy.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\ForInNext.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileReadToArray.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Func[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\FileOpen.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICreate.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICreate[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateAvi.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateButton.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateCheckbox.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateCombo.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateContextMenu.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateContextMenu[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateDate.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateDate[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateDate[3].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateDate[4].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateDummy.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateEdit.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateGraphic.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateGroup.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateIcon.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateIcon[2].au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateInput.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateLabel.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateList.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateListView.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateListViewItem.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateMenu.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateMenuitem.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateMonthCal.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreateObj.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\GUICtrlCreatePic.au3","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\INTERNAT.EXE\\INTERNAT.EXE","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67b894f2f7845e982908cb40"},{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b78ac487ca3e1394667d414"}]}]}},"report_ids":{"sandbox_job_ids":["6399e4898dbf77342220538d","6399e4861bd9a321674adccc","5b78ac487ca3e1394667d414","67b894f2f7845e982908cb40","6703e8e460f02fadc803c796"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Ransom.Ryuk Sample 23f8aa94ffb3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 23f8aa94ffb3…. Malware family: Trojan.Ransom.Ryuk. Threat score 100/100. 22/25 AV engines flagged this file. 17 malicious and 40 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.Ryuk Sample 23f8aa94ffb3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 23f8aa94ffb3…. Malware family: Trojan.Ransom.Ryuk. Threat score 100/100. 22/25 AV engines flagged this file. 17 malicious and 40 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.Ryuk Sample 23f8aa94ffb3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 23f8aa94ffb3…. Malware family: Trojan.Ransom.Ryuk. Threat score 100/100. 22/25 AV engines flagged this file. 17 malicious and 40 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]