26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 36b7f06afc92… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 36b7f06afc92…. Malware family: Trojan.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539"],"about":{"@type":"SoftwareApplication","name":"build_2017-07-26_18-48.exe","applicationCategory":["peexe","executable"],"identifier":"36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":26},"behavioralIndicators":{"malicious":12,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T747,Spawned process "" (UID: 00022761-00003824) Spawned process "cmd.exe" with commandline "/C sc stop VVS" (UID: 00023113-00000592) Spawned process "sc.exe" with commandline "sc stop VVS" (UID: 00023121-00001300) Spawned process "cmd.exe" with commandline "/C sc stop wscsvc" (UID: 00023122-00001836) Spawned process "sc.exe" with commandline "sc stop wscsvc" (UID: 00023133-00003984) Spawned process "cmd.exe" with commandline "/C sc stop WinDefend" (UID: 00023135-00004000) Spawned process "sc.exe" with commandline "sc stop WinDefend" (UID: 00023146-00004028) Spawned process "cmd.exe" with commandline "/C sc stop wuauserv" (UID: 00023148-00004024) Spawned process "sc.exe" with commandline "sc stop wuauserv" (UID: 00023158-00003936) Spawned process "cmd.exe" with commandline "/C sc stop BITS" (UID: 00023160-00003972) Spawned process "sc.exe" with commandline "sc stop BITS" (UID: 00023175-00004052) Spawned process "cmd.exe" with commandline "/C sc stop ERSvc" (UID: 00023185-00000148) Spawned process "sc.exe" with commandline "sc stop ERSvc" (UID: 00023197-00000536) Spawned process "cmd.exe" with commandline "/C sc stop WerSvc" (UID: 00023202-00002112) Spawned process "sc.exe" with commandline "sc stop WerSvc" (UID: 00023212-00002260) Spawned process "cmd.exe" with commandline "/C vssadmin.exe Delete Shadows /All /Quiet" (UID: 00023217-00002280) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00023229-00002272) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} recoveryenabled No" (UID: 00023234-00002232) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00023254-00000644) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00023261-00001796)28:T48e,"yZw6snqBQ28DAzu.exe" has type "data" "dH1rDN9f9.doc" has type "data" "lCEf83Wf7e4nuIMk.doc" has type "data" "dskCEJ.exe" has type "data" "Tmg2wsFHYf9ioO.doc" has type "data" "AB79FF111EEEA3D85B63203721B28820.ZERO" has type "data" "3B52BF8C051000129961936607A4E45A.ZERO" has type "data" "E97FEB5D26B50DB525DEE9D127E5F1FD.ZERO" has type "Sendmail frozen configuration - version \234\006\315x\365\350o\302fc\275\320\3700\260AX\246'\013Q\252\221\3627\345\374\313\313\3330\213\202w\224\317\025\236&\360\276\261\213\352\002\270t\325\211V\0207\367\217\363\225\352.C\311\212\306\246" "_HELP_INSTRUCTION.TXT" has type "data" "E0135F3A37B2655F3890BDCA39A949A7.ZERO" has type "data" "3696B3583CCD2790903A41EB3FC20BD8.ZERO" has type "data" "5yqb2pxbZ.txt" has type "data" "99549FA826CBEDB0CA3CCDE9298CD1F8.ZERO" has type "DOS executable (COM)" "A017FEC917A5BD3D75FB84D919CCA185.ZERO" has type "data" "0487B0F93B855CECC528B8CD3DCA4134.ZERO" has type "data" "722FCDEA31D12154A6D7BED133E8059C.ZERO" has type "data" "B4864C8C1DDB88FC45F468B620506D44.ZERO" has type "data" "81DF1F41447B0832476BC3A3472FEC7A.ZERO" has type "data" "PpzHcsYvXs2l.img" has type "data"29:Ta3d,"C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "C:\config.sys" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\ntuser.ini" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Contacts\desktop.ini" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\0Og1.rar" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\0gakl8ixtWMkw.doc" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\0pYWspjURe8aqA.exe" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\0zIG0D.doc" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\1q4yvQVxByym4.rar" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\1N1A3vlRdYRii5C.mp3" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\3dfFyhzUJVQSk.img" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\4nAn3p.mp3" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\7OxVHBv.avi" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\6MR6.mp3" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\6SZfLTu9z.doc" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\86iRpMfVS9o.jpg" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\8Uu9ETpS.avi" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\9rNtWnjTq9RGbU.exe" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\ar6cEZyyC.rar" for deletion "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" marked "%USERPROFILE%\Downloads\b9UD.jpg" for deletion2a:T4f5,"" wrote 32 bytes to a remote process "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" (Handle: 76) "" wrote 52 bytes to a remote process "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" (Handle: 76) "" wrote 4 bytes to a remote process "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" (Handle: 76) "" wrote 1024 bytes to a remote process "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" (Handle: 76) "" wrote 16896 bytes to a remote process "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" (Handle: 76) "" wrote 6656 bytes to a remote process "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" (Handle: 76) "" wrote 8192 bytes to a remote process "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" (Handle: 76) "" wrote 512 bytes to a remote process "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" (Handle: 76) "" wrote 2560 bytes to a remote process "C:\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe" (Handle: 76)2b:T808,Spawned process "" (UID: 00013314-00002592) Spawned process "" (UID: 00022761-00003824) Spawned process "cmd.exe" with commandline "/C sc stop VVS" (UID: 00023113-00000592) Spawned process "sc.exe" with commandline "sc stop VVS" (UID: 00023121-00001300) Spawned process "cmd.exe" with commandline "/C sc stop wscsvc" (UID: 00023122-00001836) Spawned process "sc.exe" with commandline "sc stop wscsvc" (UID: 00023133-00003984) Spawned process "cmd.exe" with commandline "/C sc stop WinDefend" (UID: 00023135-00004000) Spawned process "sc.exe" with commandline "sc stop WinDefend" (UID: 00023146-00004028) Spawned process "cmd.exe" with commandline "/C sc stop wuauserv" (UID: 00023148-00004024) Spawned process "sc.exe" with commandline "sc stop wuauserv" (UID: 00023158-00003936) Spawned process "cmd.exe" with commandline "/C sc stop BITS" (UID: 00023160-00003972) Spawned process "sc.exe" with commandline "sc stop BITS" (UID: 00023175-00004052) Spawned process "cmd.exe" with commandline "/C sc stop ERSvc" (UID: 00023185-00000148) Spawned process "sc.exe" with commandline "sc stop ERSvc" (UID: 00023197-00000536) Spawned process "cmd.exe" with commandline "/C sc stop WerSvc" (UID: 00023202-00002112) Spawned process "sc.exe" with commandline "sc stop WerSvc" (UID: 00023212-00002260) Spawned process "cmd.exe" with commandline "/C vssadmin.exe Delete Shadows /All /Quiet" (UID: 00023217-00002280) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00023229-00002272) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} recoveryenabled No" (UID: 00023234-00002232) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00023254-00000644) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00023261-00001796) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00023278-00001732)2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Ac3d3d3d3d3d3d3dmdzd3d3c3d3d3d3d3d3d3d3c3d3N3M3ZmZmIiIiZ3d3dzd3czd3MzIiIiIiImdid3c3dzN3dzMzoiZmZmZ3dndzN3dzZ3dzczd3d3d3dnd3czd2Ykdnc3c3d3d3d2J3d3N3IiRHZ2d3c3d3d3dnd3czIiJmd3Zmd3c3d3d3d3d2N3JnR3d3djN3c3d3Z3dzIjJ4d0R3d3dzd3c3d3dyIiMzeHRHd3d313d3c3cyIiZzd4d0d3d3d33d13dyIiZnc3iHdYh3eId3N91yIiZ3eDd3h3iHd3eHdXNWIiN3d4hzd3dYh3d3h3dzdiNzd3iHM3d0eHd3d4d3d3d3N3d4dzN3dId3h3eId3c3N3d3d3czd0d3eId3d3d3M2Z3d3d9eHd3eIiHd3d3dzMnc3h3d93Vd4iId3d4d3dzd3d3d3ONVHeIh3d3eId2Jnd3d3d3d0d4iKZnd3d3d2c3h3Jmd3ZdiId3d3d3h3Z2ZnZmZ4OHiNh3d3d3eqZ2d3N3d3iId4jdd3d3d3d3d3N3d3eIh3iIfXd3d3d3d3dzd3d4iHd4h33Xdnd3d3d3iHc3iINkd3d33XZnd3d3d3d3c4hzRHd3d313dmZmZ3d3d3N3d3d3d3d31Xd3dmeHZnd3d3c3d3dVXd3Xd3d4h33Yd93d3dd33d3d0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Ac3d3d3d3d3d3d3dmdzd3d3c3d3d3d3d3d3d3d3c3d3N3M3ZmZmIiIiZ3d3dzd3czd3MzIiIiIiImdid3c3dzN3dzMzoiZmZmZ3dndzN3dzZ3dzczd3d3d3dnd3czd2Ykdnc3c3d3d3d2J3d3N3IiRHZ2d3c3d3d3dnd3czIiJmd3Zmd3c3d3d3d3d2N3JnR3d3djN3c3d3Z3dzIjJ4d0R3d3dzd3c3d3dyIiMzeHRHd3d313d3c3cyIiZzd4d0d3d3d33d13dyIiZnc3iHdYh3eId3N91yIiZ3eDd3h3iHd3eHdXNWIiN3d4hzd3dYh3d3h3dzdiNzd3iHM3d0eHd3d4d3d3d3N3d4dzN3dId3h3eId3c3N3d3d3czd0d3eId3d3d3M2Z3d3d9eHd3eIiHd3d3dzMnc3h3d93Vd4iId3d4d3dzd3d3d3ONVHeIh3d3eId2Jnd3d3d3d0d4iKZnd3d3d2c3h3Jmd3ZdiId3d3d3h3Z2ZnZmZ4OHiNh3d3d3eqZ2d3N3d3iId4jdd3d3d3d3d3N3d3eIh3iIfXd3d3d3d3dzd3d4iHd4h33Xdnd3d3d3iHc3iINkd3d33XZnd3d3d3d3c4hzRHd3d313dmZmZ3d3d3N3d3d3d3d31Xd3dmeHZnd3d3c3d3dVXd3Xd3d4h33Yd93d3dd33d3d0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==31:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==33:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==35:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==37:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==39:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266071310,"unified_at":"2026-09-24T16:07:51.310Z","metadata":{"hashes":{"sha256":"36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539","sha1":"e5f581595cf039b6baf4edd9f9569a62de0c71d8","md5":"8097d2a327824e417b57e0546464b9d6","sha512":"6ffb4716ac72bfc95e0c942f0a1bba94a579fb5547106bd2e4f72ae4c1d6d54197187185dac9d0daa36ec1adc1ede82433aaa7c2ad287f55737e60cc97b4e1fa","ssdeep":"3072:wkwWTSiP4fCa57faJR35EWWhOHCDGISxkQY//:fwTS4fwH5zWh8vIP","ssdeep_chunks":["3072:wkwWTSi","3072:kwWTSiP","3072:wWTSiP4","3072:WTSiP4f","3072:TSiP4fC","3072:SiP4fCa","3072:iP4fCa5","3072:P4fCa57","3072:4fCa57f","3072:fCa57fa","3072:Ca57faJ","3072:a57faJR","3072:57faJR3","3072:7faJR35","3072:faJR35E","3072:aJR35EW","3072:JR35EWW","3072:R35EWWh","3072:35EWWhO","3072:5EWWhOH","3072:EWWhOHC","3072:WWhOHCD","3072:WhOHCDG","3072:hOHCDGI","3072:OHCDGIS","3072:HCDGISx","3072:CDGISxk","3072:DGISxkQ","3072:GISxkQY","3072:ISxkQY/","3072:SxkQY//","6144:wkwWTSi","6144:kwWTSiP","6144:wWTSiP4","6144:WTSiP4f","6144:TSiP4fC","6144:SiP4fCa","6144:iP4fCa5","6144:P4fCa57","6144:4fCa57f","6144:fCa57fa","6144:Ca57faJ","6144:a57faJR","6144:57faJR3","6144:7faJR35","6144:faJR35E","6144:aJR35EW","6144:JR35EWW","6144:R35EWWh","6144:35EWWhO","6144:5EWWhOH","6144:EWWhOHC","6144:WWhOHCD","6144:WhOHCDG","6144:hOHCDGI","6144:OHCDGIS","6144:HCDGISx","6144:CDGISxk","6144:DGISxkQ","6144:GISxkQY","6144:ISxkQY/","6144:SxkQY//","3072:fwTS4fw","3072:wTS4fwH","3072:TS4fwH5","3072:S4fwH5z","3072:4fwH5zW","3072:fwH5zWh","3072:wH5zWh8","3072:H5zWh8v","3072:5zWh8vI","3072:zWh8vIP"],"imphash":"e13666ef4dde152759add365e6903c99"},"file_info":{"file_name":"build_2017-07-26_18-48.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":197120,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1501325761000,"last_seen":1647458344000,"last_multi_scan":1647458344000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":17,"malicious_count":12,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.toTC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Scarsi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1223940","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CKDZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Crypt.BAA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-a759fa4c!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.BTCWare (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FUYL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051311b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Deshacop.gbg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Emotet-FAV!8097D2A32782","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.erhslk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.GlobeImposter.A4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Emotet-C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.512FD177","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.512FD177","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Inject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00013314-00002592-25239-16-03001C33\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013314-00002592-25239-17-03005BCC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013314-00002592-25239-223-0300BA64\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013314-00002592-25239-457-03003C57","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00013314-00002592-25239-194-03004827","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\760D3222_offset\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"760D3222_offset\"\n \"DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C sc stop VVS\" on 2017-7-29.11:48:02.787\n \"/C sc stop wscsvc\" on 2017-7-29.11:48:02.907\n \"/C sc stop WinDefend\" on 2017-7-29.11:48:02.998\n \"/C sc stop wuauserv\" on 2017-7-29.11:48:03.128\n \"/C sc stop BITS\" on 2017-7-29.11:48:03.258\n \"/C sc stop ERSvc\" on 2017-7-29.11:48:03.508\n \"/C sc stop WerSvc\" on 2017-7-29.11:48:03.678\n \"/C vssadmin.exe Delete Shadows /All /Quiet\" on 2017-7-29.11:48:03.819\n \"/C bcdedit /set {default} recoveryenabled No\" on 2017-7-29.11:48:03.999\n \"/C bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2017-7-29.11:48:44.269","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\OLEACCRC.DLL\"\n \"\" touched file \"%WINDIR%\\System32\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\cmd.exe\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00022761-00003824-00000105-66965567","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.19182923893","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"sc.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\ntuser.ini\"\n \"\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Favorites\\Links\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"sc.exe\" called \"OpenService\" to access the \"VVS\" service\n \"sc.exe\" called \"OpenService\" to access the \"wscsvc\" service requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"WinDefend\" service\n \"sc.exe\" called \"OpenService\" to access the \"wuauserv\" service requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"BITS\" service requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"ERSvc\" service\n \"sc.exe\" called \"OpenService\" to access the \"WerSvc\" service requesting \"SERVICE_STOP\" (0X20) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"BITS\"\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WerSvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"99549FA826CBEDB0CA3CCDE9298CD1F8.ZERO\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"00FF760D3222\"; Value: \"\"C:\\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe\"\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"BC760D3222\"; Value: \"\"%ALLUSERSPROFILE%\\BC760D3222.exe\"\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"*BC760D3222\"; Value: \"\"%ALLUSERSPROFILE%\\BC760D3222.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$29","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\config.sys\" with delete access\n \"\" opened \"%USERPROFILE%\\Users\\anW02jW\\Desktop background.png\" with delete access\n \"\" opened \"C:\\Recovery\\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\\Winre.wim\" with delete access\n \"\" opened \"%USERPROFILE%\\ntuser.ini\" with delete access\n \"\" opened \"%USERPROFILE%\\Contacts\\desktop.ini\" with delete access\n \"\" opened \"%USERPROFILE%\\Contacts\\%OSUSER%.contact\" with delete access\n \"\" opened \"%USERPROFILE%\\Downloads\\0Og1.rar\" with delete access\n \"\" opened \"%USERPROFILE%\\Downloads\\0gakl8ixtWMkw.doc\" with delete access\n \"\" opened \"%USERPROFILE%\\Downloads\\0pYWspjURe8aqA.exe\" with delete access\n \"\" opened \"%USERPROFILE%\\Downloads\\0zIG0D.doc\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe.bin\" claimed CRC 229340 while the actual is CRC 234815","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n GetFileSizeEx\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n GetModuleHandleW\n TerminateProcess\n CreateFileW\n Sleep\n CreateFileA\n GetTickCount\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/C bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00023261-00001796)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00023278-00001732)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"41/64 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"41/64 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"41/64 Antivirus vendors marked spawned process \"\" (PID: 3824) as malicious (classified as \"Trojan.Generic\" with 64% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2a","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00023229-00002272)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_HELP_INSTRUCTION.TXT\" which has been seen in the context of ransomware (Indicator: instruction.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wscsvc\" (Indicator: \"wscsvc\")\n \"wuauserv\" (Indicator: \"wuauserv\")\n \"/C sc stop wscsvc\" (Indicator: \"wscsvc\")\n \"sc stop wscsvc\" (Indicator: \"wscsvc\")\n \"/C sc stop wuauserv\" (Indicator: \"wuauserv\")\n \"sc stop wuauserv\" (Indicator: \"wuauserv\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"System Security","name":"Requested access to a critical system service","description":"\"sc.exe\" called \"OpenService\" to access the \"wscsvc\" service (\"Windows Security Center\") requesting \"SERVICE_STOP\" (0X20) access rights\n \"sc.exe\" called \"OpenService\" to access the \"WinDefend\" service (\"Windows Defender\")\n \"sc.exe\" called \"OpenService\" to access the \"wuauserv\" service (\"Windows Update\") requesting \"SERVICE_STOP\" (0X20) access rights","origin":"API Call","relevance":10,"id":"api-79","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"System Security","name":"Sent a control code to a critical system service","description":"\"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\" (\"Windows Security Center\")\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\" (\"Windows Defender\")\n \"sc.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\" (\"Windows Update\")","origin":"API Call","relevance":10,"id":"api-78","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"System Security","name":"Tries to disable/delete the windows firewall","description":"Process \"sc.exe\" with commandline \"sc stop WinDefend\" (UID: 00023146-00004028)","origin":"Monitored Target","relevance":10,"id":"target-18","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2b","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]}]},"activity":{"stats":{"process_count":22,"spawned_processes_count":22,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":52,"dropped_files_count":0,"extracted_files_count":25,"files_written_count":390,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"597c67757ca3e1034145ccf3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"build_2017-07-26_18-48.exe","analysis_start_time":"2017-07-29T11:45:18+00:00","indicators_count":{"informative":11,"suspicious":20,"malicious":17},"tags":["Multi-Process","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}],"processes":[{"pid":2592,"ppid":0,"name":"36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe","command_line":"","sha256":"36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539","normalized_path":"C:\\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe","uid":"00013314-00002592","icon":"$2c"},{"pid":3824,"ppid":2592,"name":"36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe","command_line":"","sha256":"36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539","normalized_path":"C:\\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe","parent_uid":"00013314-00002592","uid":"00022761-00003824","icon":"$2d"},{"pid":592,"ppid":3824,"name":"cmd.exe","command_line":"/C sc stop VVS","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00022761-00003824","uid":"00023113-00000592","icon":"$2e"},{"pid":1300,"ppid":592,"name":"sc.exe","command_line":"sc stop VVS","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00023113-00000592","uid":"00023121-00001300","icon":"$2f"},{"pid":1836,"ppid":3824,"name":"cmd.exe","command_line":"/C sc stop wscsvc","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00022761-00003824","uid":"00023122-00001836","icon":"$30"},{"pid":3984,"ppid":1836,"name":"sc.exe","command_line":"sc stop wscsvc","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00023122-00001836","uid":"00023133-00003984","icon":"$31"},{"pid":4000,"ppid":3824,"name":"cmd.exe","command_line":"/C sc stop WinDefend","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00022761-00003824","uid":"00023135-00004000","icon":"$32"},{"pid":4028,"ppid":4000,"name":"sc.exe","command_line":"sc stop WinDefend","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00023135-00004000","uid":"00023146-00004028","icon":"$33"},{"pid":4024,"ppid":3824,"name":"cmd.exe","command_line":"/C sc stop wuauserv","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00022761-00003824","uid":"00023148-00004024","icon":"$34"},{"pid":3936,"ppid":4024,"name":"sc.exe","command_line":"sc stop wuauserv","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00023148-00004024","uid":"00023158-00003936","icon":"$35"},{"pid":3972,"ppid":3824,"name":"cmd.exe","command_line":"/C sc stop BITS","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00022761-00003824","uid":"00023160-00003972","icon":"$36"},{"pid":4052,"ppid":3972,"name":"sc.exe","command_line":"sc stop BITS","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00023160-00003972","uid":"00023175-00004052","icon":"$37"},{"pid":148,"ppid":3824,"name":"cmd.exe","command_line":"/C sc stop ERSvc","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00022761-00003824","uid":"00023185-00000148","icon":"$38"},{"pid":536,"ppid":148,"name":"sc.exe","command_line":"sc stop ERSvc","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00023185-00000148","uid":"00023197-00000536","icon":"$39"},{"pid":2112,"ppid":3824,"name":"cmd.exe","command_line":"/C sc stop WerSvc","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00022761-00003824","uid":"00023202-00002112","icon":"$3a"},{"pid":2260,"ppid":2112,"name":"sc.exe","command_line":"sc stop WerSvc","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00023202-00002112","uid":"00023212-00002260","icon":"$3b"},{"pid":2280,"ppid":3824,"name":"cmd.exe","command_line":"/C vssadmin.exe Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00022761-00003824","uid":"00023217-00002280","icon":"$3c"},{"pid":2272,"ppid":2280,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00023217-00002280","uid":"00023229-00002272"},{"pid":2232,"ppid":3824,"name":"cmd.exe","command_line":"/C bcdedit /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00022761-00003824","uid":"00023234-00002232","icon":"$3d"},{"pid":644,"ppid":2232,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00023234-00002232","uid":"00023254-00000644"},{"pid":1796,"ppid":3824,"name":"cmd.exe","command_line":"/C bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00022761-00003824","uid":"00023261-00001796","icon":"$3e"},{"pid":1732,"ppid":1796,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00023261-00001796","uid":"00023278-00001732"}],"all_imported_dlls":["KernelBase.dll","gdi32.dll","uxtheme.dll","msasn1.dll","oleaut32.dll","clbcatq.dll","psapi.dll","vsstrace.dll","user32.dll","shell32.dll","ole32.dll","propsys.dll","urlmon.dll","wininet.dll","msvcrt.dll","msctf.dll","apphelp.dll","shlwapi.dll","cfgmgr32.dll","Wldap32.dll","profapi.dll","atl.dll","kernel32.dll","imm32.dll","RpcRtRemote.dll","advapi32.dll","mpr.dll","setupapi.dll","devobj.dll","ieframe.dll","userenv.dll","ntdll.dll","dwmapi.dll","sspicli.dll","cryptbase.dll","rsaenh.dll","vssapi.dll","vss_ps.dll","rpcrt4.dll","usp10.dll","comdlg32.dll","comctl32.dll","sechost.dll","oleaccrc.dll","oleacc.dll","winbrand.dll","lpk.dll","crypt32.dll","rpcss.dll","iertutil.dll","ntmarta.dll","cryptsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"F06C3C509054X0B7D28ZCDDBB17087B9C3E.ZERO","sha256":"71d8f0c8bf0a92363dc6b5ef2ac8befc1f7c04ded1a8969a1f95e24dc3f6cbb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"db8eb3a2692cd892d2f0d4ddc2315204_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"11e11d14a0636a9391de170774e6de33b1c4a9f7106547bccb30acd51be386f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"3746A600130056007009264D15073A48.ZERO","sha256":"b3fbac1b2797aa23d116cbebdbda5166ed9f6f6fb705458a233b711f99e3ea28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"386EFDF21C20D56F0B107D921E17B9B7.ZERO","sha256":"1dc6881c08cc4d44027d3f5dde71219b14cd9a43c38571dc59d5ba70e0ae3ce6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"DCC86EC234F238D0BE517E2A36231D18.ZERO","sha256":"a7289aa2a636e68a70a95f7a7bf1ada948bd88410fce58837d516cb6dc5d7c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"FC2A65C0315186209CCF6AB633686A68.ZERO","sha256":"b94151e6cfe483932bc717fb1b789f912398e647a18c2cf94e69129ec400bb36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"0050D6833DADF704D8E485193FF2DB4C.ZERO","sha256":"804cd910395445511e2fe4538bca76ac1e8c0ce995581e603032e715745acb03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"01858B903D275A3586EAA3703FA73E7D.ZERO","sha256":"5688766d32350882ea4e753bde028c198fb56e0eacc124a92e1cc91b5f7aa8fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"04115FE4166D84FE2C3BD5FA18FD6946.ZERO","sha256":"4df86e5251cbde4804ebc51909231574b4ab850325f63bf16cfcb2e35dc827f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"0487B0F93B855CECC528B8CD3DCA4134.ZERO","sha256":"1203ae0690908694229bfd4c5576fa66422994f902b9ffdd6df6d4c08af19acf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"074F08D62B6D06CD1F7331DA2DB1EB15.ZERO","sha256":"b34c145045005866d8534839c0e7b1388f43297606e533e5edd1a270c6d28c8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"079B95920F5367D80398A85514134C20.ZERO","sha256":"c8c1de44a500e33837fae492210af6cdd1dfca7183d0e2ef7b20d5411324815b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"08B074D03720D236C233E5103A03B67E.ZERO","sha256":"120e0a6daf49b07e9134e52ec1cb14dec57c9bad767823c86ec7ee34109f6ccd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"0AAF4EB13C8ED5266895EED33F03B96E.ZERO","sha256":"54ec8a74f4765af0f62a61265b588966e27ed545dda44aa6d8f88a1609903d74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"0BC4EBB01F6E795C250F6B1421915DA4.ZERO","sha256":"5bcf93616926532b2b3604fd0de594485e14ea5db3585fb3e67c9ea405015fa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"0BC6817D2DE56D43DAF425F72FDC518B.ZERO","sha256":"6c53a9d354da4e8ee79123715bb0cf745b6258931dd20426f0625672aa436a34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"0D8E5BEC009E757FC819D1E402A559C7.ZERO","sha256":"1737bed51faafcc6243bc11b423a3be80b15776b879ceb9c936fbc6895fd8733","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"0F7D60E0012C54D803359E7003E43920.ZERO","sha256":"959b2f0bb58ee568ddc4761ca063b7cd55968c8eebdbcf65e7156132477a180a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"102A778036254D3EF400F08038F63186.ZERO","sha256":"a9abc9cce6568c226ac937f10bf2592ce555372c846835a07841f734aa643dfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"13806FB62EDDE31EB1C8A1733122C766.ZERO","sha256":"dadd40d2e89321dc5a700ec76546805ae172b74e7e204fb7d2364b2ca1881332","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"6ff77b339af2944e33089fe8e9226b6308bfe33aa1f507418b8ef92fb8adc203","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"dH1rDN9f9.doc","sha256":"618c0a77e22929fba766b839ef3180aeeb96e0599196eb7633443388716b65fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"dskCEJ.exe","sha256":"a1c0721024ea887b411d507245be13a8a9213e45e61d32abbb320383e5decb3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"e7e4f473665a1541f64c6973edb0633a8b407a7fe3ea66c20df56802f11ac9be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"1ef96aeccdf950d6927e7ec381933bbb4bbe3eefcf7873675e60e02756fb10ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]}],"files_written":[{"path":"C:\\isahdbfioasdf aiosdf aisoduyfhgoaisduhfhiasbdfisduahfaiosd","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\system32\\en-US\\sc.exe.mui","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\system32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%ALLUSERSPROFILE%\\BC760D3222.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%ALLUSERSPROFILE%\\BC760D3222.exe","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%ALLUSERSPROFILE%\\BC760D3222.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%ALLUSERSPROFILE%\\F06C3C509054X0B7D28ZCDDBB17087B9C3E.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\1501325134642$OK","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539.exe","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\K95.wNw","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\config.sys","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\gWTk3jKgZjMih.sgO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\D364D03A25E030DE6D815DBE27111526.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\E0135F3A37B2655F3890BDCA39A949A7.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\QrsVicxg2cFVBYi31Unz.JFh","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\3pgSGUddFLmfG4V8uwWTyja0.ZEf","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\LIk86h1Lb.f8K","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\HtbkK3Y6C.DJa","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\$Recycle.Bin\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\Ae8vC2P4\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\Documents and Settings\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\MSOCache\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\MSOCache\\All Users\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\PerfLogs\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\PerfLogs\\Admin\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%PROGRAMFILES%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%ALLUSERSPROFILE%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\Recovery\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\Recovery\\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\System Volume Information\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\Users\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"C:\\Users\\0E900F763A7156EDC177710A3CD43B35.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\E593D5C046AAD665A6620D40491DBAAD.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\AppData\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%APPDATA%\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\DCC86EC234F238D0BE517E2A36231D18.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Contacts\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Cookies\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Documents\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Documents\\My Music\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Music\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Documents\\My Pictures\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Pictures\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Documents\\My Videos\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Videos\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Documents\\Visual Studio 2008\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Documents\\Visual Studio 2008\\Templates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Documents\\Visual Studio 2008\\Templates\\ItemTemplates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Documents\\Visual Studio 2008\\Templates\\ProjectTemplates\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Contacts\\386EFDF21C20D56F0B107D921E17B9B7.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Contacts\\3746A600130056007009264D15073A48.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\01dMtnkBz9.gif","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Documents\\FC2A65C0315186209CCF6AB633686A68.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\04bZ.txt","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\60DB2AC82A339C1E0CFD84C82C5A8066.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\EC749E8339A1809AD97D77C93BD864E2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\0gakl8ixtWMkw.doc","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\0Og1.rar","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\0pYWspjURe8aqA.exe","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\155BD1340EBB7D2C91BB341E10EE6174.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\FBE254EE3C95E79E8F5394C13EB8CBE6.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\7A370CB41AD3AF74851499091DB093BC.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\F249A3823ADA4DBBC38BD52E3DEE3203.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\3Awf.mp3","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\8AA7E7F60C8266388959446E0FBD4A80.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\27C196281501838482DCA296172467CC.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\3dfFyhzUJVQSk.img","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\235F1EFC472EA57E8B79694E4A1289C6.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\9CE546B61655B633D42AA6AE19499A7B.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\4lpro8p6KuJo0.mp3","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\4nAn3p.mp3","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\D5C5A7D227038D64801F4191283471AC.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\A4EE6B60224DB270835D8672246A96B8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\7A85A9E41E6D8CD83639101120647120.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\366937402F0B320031501BD9322F1648.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\F98D74233CE1910ED877581D3EE87556.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\2B1FEE35423E031042ACE73F4474E758.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\814F9CD63A67059F85E2A6363C9DE9E7.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\83F9C8FD28ECC381760225EB2AE3A7C9.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\9E87F5B819FC85A0DEE4A7DE1C9669E8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\D30782D034F44EC462A6B15C377E330C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\7871D90225868E8417DFC33127E272CC.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\0BC6817D2DE56D43DAF425F72FDC518B.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\A017FEC917A5BD3D75FB84D919CCA185.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\6DAA04080E3AB0882E420CEC111E94D0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\A8A74DB42B523E4D2635483C2E122295.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\B2OE.pdf","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\08B074D03720D236C233E5103A03B67E.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\F9F08D420E876381A76C1C0610AE47C9.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\547C3E1E427811E2F95C6842459BF62A.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\2584A40F3FA708688F0065ED4289ECB0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\E2CCCC3E309191C7C5C6BB123384760F.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\1699763032E9DB20F9A007AE3510BF68.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\FF74FD0C014A9BCDF44F5C94027B8015.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\BE492B4548A50DF54756FE074B09F23D.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\38219B8F29D8DD711652AF9D2C1DC1B9.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\8384A0004380F000C51D591644B1D448.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\04115FE4166D84FE2C3BD5FA18FD6946.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\EDE1AE513D296ECAC0A624893FC95312.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\13806FB62EDDE31EB1C8A1733122C766.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\5725D5201C2CD1A83DCABFC81EFFB5F0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\5D957D931444FF340F7D517B16B9E37C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\daTAwNa1cRBbYO.avi","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\651968981874554866F62AA31B133990.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\BA3FD3BC14F2AA308C833C4517378E78.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\756E53900E8605A2C8724598116AE9EA.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\3696B3583CCD2790903A41EB3FC20BD8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\dgQJde60mPXhI.exe","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\A9E7B73D196A3EBB8A9996471BAF2303.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\3A9D4F3F481FFEF34DB6B2034A84E33B.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\ecazG0z.rar","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\DE79250C2249D058AE48D5E3248EB4A0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\AB79FF111EEEA3D85B63203721B28820.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\35EABF8C2B9ECA0CCD18A13E2DE3AE54.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\F3hzum1.doc","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\A057F454345D4DA82255E31F36A231F0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\3D4E5A0E0FCBFE4B5AD62AF210FCE293.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\fkHEBb1SV.txt","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\BEB8C3383D9BE5680AA91B593ECCC9B0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\0BC4EBB01F6E795C250F6B1421915DA4.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\99549FA826CBEDB0CA3CCDE9298CD1F8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\102A778036254D3EF400F08038F63186.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\B7C8544426DC2E3454C3EA4328FF127C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\517E6BB84495892AF8FD1C9448836D72.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\BB2FFBC229C2E83A7C280D9A2C93CC82.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\AA3ED076268437F75F31A57A2BD21C3F.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\hsQjJvLaP.jpg","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\D4AC70FC30E528C878D4E4EA330A0D10.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\CA9480581496FBD602FF6CD81746E01E.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\C4E099600BE31A0D4F0FECA00EDEFE55.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\16958BFA310C51D72CCDC29633BC361F.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\8E0F0CBC25DA0C3CD715FEF12959F084.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\4B5DACCB25939E8AD9D6BFB72A1B82D2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\kdo6iAicsoicvHg.exe","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\9A3D22342F8B75DE08248242323B5A26.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\6F446C680B7DEB28DB8EB1730E3DCF70.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\3180D96843603F546B66A03E486D239C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\BA274D321B5F9270B50BA07F209176B8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\949D76681245DD3412E7499E152CC17C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\254F69DC293965CA0FBF76942A6A4A12.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\0050D6833DADF704D8E485193FF2DB4C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\7D5401C1052633DDE61EA05F073D1825.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\0487B0F93B855CECC528B8CD3DCA4134.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\C5CEC588015DD964011C05EA0605BDAC.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\9C7F6BA02255F8CAD1860A2026CFDD12.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\074F08D62B6D06CD1F7331DA2DB1EB15.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\615320B003CA5CA8B67FD20E06EE40F0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\29936313303250E887DD08ED32533530.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\A3E9F5F4018E07EDEBC6FAF403D2EC35.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\01858B903D275A3586EAA3703FA73E7D.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\23343B401DA5B3C08F2D737F20999808.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\0F7D60E0012C54D803359E7003E43920.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\F92D8F8635F6E1A0D4453B22385BC5E8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\BE868C1C12D39452EAE68E2C1518789A.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\db8eb3a2692cd892d2f0d4ddc2315204_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\91388AC0211813106EA1AC3C2515F758.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\4187D5CE2CFE16191B284D7E30EBFA61.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\16ECAD1A42A46B58F8842F42459C4FA0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\746799A43E14F82F57D61E4442F2DC77.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\0D8E5BEC009E757FC819D1E402A559C7.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\0AAF4EB13C8ED5266895EED33F03B96E.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\17BA3DA316E4D5D99AF3D9D91AD2BA21.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\14F676503341C3A0A54240DF3639A7E8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\ECC2C4C40F851666557457DA1382FAAE.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\E6710B6E06854322DC34BD060AA3276A.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\6DCE9F8E3D0B93014328CD9A41197749.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\C97562A00A1E42F8ECDD30A40C832740.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\BB4620F033F2FC6061F48FD03820E0A8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\86CD351225F41B5CDC89647127FAFFA4.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\F181EC6C29776434CEC9C6C32B3E487C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\F9A0603B109A6B45C04AF75912FF4F8D.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\D9DD5B5211693D357F3B5A0A138E217D.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\FE0FF47039F91438AF03790E3C3DF880.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\888A8FC512FD326370208A5515D316AB.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\7C54343F087CA3E3F1CC543F0BA0882B.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\5742AC4041B91C4024B9AC04448A0088.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\D7E610990AD1406B82FB5E830DCF24B3.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\FFC7912E0DE68AEC2966F90D102B6F34.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\079B95920F5367D80398A85514134C20.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\xqjUvzokp0.avi","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\57120DCB2F16E9712E73373F30DDCDB9.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\D49BB3550912BFFA75961D890B57A442.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\_HELP_INSTRUCTION.TXT","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\60CDDF4C1C1DE7E88E9DF7B91FEDCC30.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\CFC6BA3C46FC297CC5C3C8C24A8C0DC4.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Downloads\\A5C4AD442C41E35A1D4C007C3001C7A2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\A1EC5B551F88813CF10949DB24076584.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\CE6A367A3EF1BD17AEFB96F243AEA15F.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\EAB6043D44A1723488DB7D074881567C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\A6DF90192C2813BBB72BBDC12FE7F803.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\40A4E489011B8CE8290A59E305E87130.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\E085CCF63E01EB20E7919D424191CF68.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\EEDF90103CD8B0500CDA8B143ECF9498.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\9976E67C1720A55C0D8EF70B185189A4.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\44CABC50487D9A8A2347C8984A447ED2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\C4E582C83E4ECE142767C5864025B25C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\873B59F42D484EAAED8749962F3F32F2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\9EE678A04C014E505C6C65624E083298.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\6B1EEFE003D8C215403510E0061DA65D.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\359EBED44523F130A7658D864788D578.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\E78ED4CE03593BE21BE8B6A20570202A.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5BCA00C80FAD3E7E04E0733C122222C6.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5A678C500491F748DE7B10120716DB90.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\BA31D9811B1E0C621A36DE0F1DE2F0AA.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\3B52BF8C051000129961936607A4E45A.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\11AFB6023162FB648A207CDD3417DFAC.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\B6CF947A0D599A5984C176CE0F207EA1.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\78743AD83D8B794834083CA840305D90.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\AE264126386495AAABA5852B3B5979F2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\E7C10EAE1A0B1F588B2719DF1CF003A0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4FCC3E6E23EF1726E0453B4F251FFB6E.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5CEDC44A23F4EDF41FC082922718D23C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\6EC8160E37AC3C827F858DC53A8120CA.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\342F93A102D4BE668677450304ABA2AE.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\262B4D1E08E23256CCD2B0170A13169E.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\D00537DD1B121ACF3D6B76C71CD8FF17.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\516C8C04437FB1A269A9E364457695EA.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\BE4C82A311802DB9B6F242D513571201.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\722FCDEA31D12154A6D7BED133E8059C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\B50467772FAAD4A0B97E90B731B1B8E8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2E1B8A5C126223D64F3AEE2C1393081E.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\0977E9BA11275242D579C0D7136C368A.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\64FE643313831FCE444F9D9D154A0416.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\F9DD08441D1B26F61438C7821F120B3E.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\E64FABF010FA8DE0A8929E7F135F7228.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2FCB32942EA4CF10C0DF350C3119B358.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\F31501FD3AC17273D69C326D3C9856BB.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\C603A7561AADD74CA9822E911D32BB94.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\291B1201257F06B280789F752813EAFA.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\3585D24021276E97AE50C7C0233E52DF.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\FA7568FC46B6A87EBD91066E48BD8CC6.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\9244174135B0DB7429732F1137F5BFBC.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5C09C5C01B8E637A205C0EE01CBF47C2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\B8B5B7423FA6B449A25DA522416D9891.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\14141F72115E3D0E65CE024313352156.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\D78E6E8E36BAD6179830F6CA38D1BA5F.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\33654010140269C8D42E6DCE16094E10.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\57CD0EEE447E22ABB398DBDA467506F3.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\410585DB1F1E55CCEF5A51F720E53A14.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\D5433E302FE2E910D26350F53209CD58.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\8E31D59A1CED435FCD30A3CE1F5227A7.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\56C15C70249456F0C4F3D81A27093B38.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4C123BEC10D7C4DB31B4AA34130EA923.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\AEA35C1B3855BF5F75734D133A2CA3A7.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\0E6447F00E4FE48D9A23CFB01056C8D5.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\963485A84205102AFA073F444489F472.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2D4AB2D40C4A9B0FFF31F7640EDF7F57.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\6F14F4500A963EBA8A2DB7B00C8D2302.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\8A173D3601AEDCEA84B156DB0375C132.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2FDAAF82123CFC7833DC82C51453E0C0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\57933400310997C0465DA69033307C08.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\duowan.com.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360230470AE37EBBBF9C822F0C146303.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.co.uk.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\CB3A87C839862B2F17BDC5D83AB70F77.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\59302B521E2AA6B348F9D51E1FF18AFB.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\E43162602FA57AB0253499B8317C5EF8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\60251BEE0A277FC4C042FB5A0B58640C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\E49F6A5614298E1054C0F47915F07258.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5A5CA8C03EBF1190359085D84095F5D8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\C03B16E020EEFEB8826D1CB422F5E300.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2BC2522A271F7B82370D10C329365FCA.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\D851F1D22116C2AAD4128877233DA6F2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5A9B3FC0109F29F0C0F657D812960E38.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\DA6B2D5709215BF54DB81F610A52403D.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\D440A7941D4DA50EC2C1345A1E7E8956.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\BA3BE0C0228407F805B4E7A8244AEC40.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\AE756C8A332EE164EDC1F4A93505C5AC.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\323E9AF213C48C2C128C46ED15DB7074.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\64F751C00B7B37302A971F100D721B78.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\43114E101BFB02DCBEFBAD841E5FE724.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\639074ED113CC940C4172DCD1343AD88.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\A5A911604FA655ECD050829851CD3A34.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\14E6EBEC036C750CEE7DEAA905F15954.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\B5FA1854398A58D8E06C9B0D3B513D20.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\35BAC2643F1573C0842DA306418A5808.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\C4692B2B027983DC0B3585E304B06824.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\9494F7F83BDF312C9774345A3E741574.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\D44970A41A695C6E0CB5F3B21C4040B6.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\28D7F6084608DC38FB22818348ADC080.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\0EE14B303E5C3F68ED26F2CE407323B0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\656556D83EEEDE30FE92789B41C3C278.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\39DFBE0E29DD3286833A1BE22CA216CE.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\99322AC30D139BAA940E07810FC87FF2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\CE653CB018AA18A0ABB8DBD31AA0FCE8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\32549C3D07FCE19D473A679F0AE1C5E5.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\E97FEB5D26B50DB525DEE9D127E5F1FD.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\270DE96A47AE539868ECC143498537E0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\D75ACDDD29D1436C65CB7E8D2BC827B4.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\C64AA3240794CA80FA7181B608C5AEC8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\055F705502203C94EE7298BF042720DC.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\E0F7F37647D83C12A95F8FC549EF205A.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4DB6187219C87E72F07B19FF1BEF62BA.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1D94E230372B34E0790A246439621928.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\3E0575920FCA599CC77513DD123F3DE4.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\0B61FD3C3AE327EC19416AFC3D480C34.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\DEF5FC173800019B2C7CAA333A84E5E3.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1558CC191F8C2448D434C7D321930890.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\9DF647213D77F8DBA86E0F113F4EDD23.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2C35DA320BAAA9281E0FE6790DA18D70.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\165580DF2D791D00D78DAB99300E0148.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\B2368E7011F4D620E2F318FB1325BA68.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1CAC812D386A697E11D81FF93B1F4DC6.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\AAF5ED98015CB9616537D88804219DA9.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\CF9A6CF62C8DFAAA03AE84722EA4DEF2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\0669E01122EEEB17744A11AD2593CF5F.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2ED745E417EDEBF449CE03DF1AC2D03C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7A6D698C03397EF06B5C40AC046A6338.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5E44F12C20FEBF44DB7C758222D5A38C.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\B7436FBF26733C7509899C93286A20BD.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\FCE162C0432D074071801EE74533EB88.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\49317AA030E7DC3B94DDC8E0330EC083.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\DF37045B364A9C69187963BB386180B1.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\FF2ABE5231DA4FDFEEC3063A343F3427.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5B894FDB3BE1AEFC01CEB7AF3E189344.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\C19D5877455F3792F360B32F47E41BDA.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\84624EA0416CB17CD7D2D1D0440195C4.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\B4864C8C1DDB88FC45F468B620506D44.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\77FA02E90F21A87DC3DEAA7311C68CC5.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\B44264F204FDFA7EF2921F490704DEC6.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\117909A8181E18006E93890E1A14FC48.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\AFAFCB6107500E6A0BC9C8BB0976F2B2.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\9694F0C842ED6C2028FBE97A44C45068.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\81DF1F41447B0832476BC3A3472FEC7A.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\A5AD5734050DD380AF140B450772B7C8.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\B8CE5B081271758849EBD06C148859D0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\C75A3DE82A77D588A1E6EE282CAEB9D0.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\BE9C2ED010AA885099B6D4D1136F6C98.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ocn.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7E08E1E8365BA9D074905144378C8E18.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\00329BE839F381BC68A5693A3BCA6604.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\3F39FEF0015C05A2FF4944780352E9EA.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partypoker.com.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\85D962F0069090A60D779FE8089774EE.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paypal.com.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\3D9A6AD835E4C2D86C54B5E73715A720.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\picnik.com.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pconline.com.cn.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\photobucket.com.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pog.com.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pogo.com.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\52D240E546B1D1EB57BB1A8948D8B633.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pps.tv.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\FD11AA0A3CF01D1A318A9FC33F270162.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\FC79137B11EC5DB613984F4B140341FE.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2A6F1EB4293185971F5EAD442B9669DF.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\B1C1F68A01FFDF64CAD25D160474C3AC.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qidian.com.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qiyi.com.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pptv.com.url","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\32B31A8A1C246F91151BA7BE1DFB53D9.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\3AFD4E201F1F6DF8960C59B821B45240.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\439452943458D41E10AF8E4636DDB866.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\9A7918403F2A0CF655B8EAE0405AF13E.ZERO","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\760D3222_offset","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"760D3222_offset","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"597c67757ca3e1034145ccf3"}]}]}},"report_ids":{"sandbox_job_ids":["597c67757ca3e1034145ccf3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 36b7f06afc92… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 36b7f06afc92…. Malware family: Trojan.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 36b7f06afc92… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 36b7f06afc92…. Malware family: Trojan.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/36b7f06afc92dbbb9ae973c0ce7ae69c6c49a62df9d1d42c64fe9266f560d539"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 36b7f06afc92… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 36b7f06afc92…. Malware family: Trojan.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 12 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]]