26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Encoder Sample 9abf83adb634… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9abf83adb634…. Malware family: Trojan.Encoder. Threat score 100/100. 18/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca","keywords":["Malicious","Trojan.Encoder","malware analysis","sandbox report","threat intelligence","9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Encoder","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5d8,".exe" queries volume information of "C:\" at 00011075-00003196-00000046-9493465780 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-9618581181 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-10082072854 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-10137062222 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-11698139585 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-23407033062 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-23527532751 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-23829963680 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-24016249369 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-26976732887 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-30984516858 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-31195540731 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-31900107093 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-37501187743 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-3755439910228:T5d8,".exe" queries volume information of "C:\" at 00011075-00003196-00000046-9493465780 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-9618581181 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-10082072854 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-10137062222 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-11698139585 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-23407033062 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-23527532751 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-23829963680 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-24016249369 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-26976732887 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-30984516858 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-31195540731 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-31900107093 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-37501187743 ".exe" queries volume information of "C:\" at 00011075-00003196-00000046-3755439910229:T441,".exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") ".exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") ".exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") ".exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") ".exe" touched "Recent Places Folder" (Path: "HKCU\WOW6432NODE\CLSID\{22877A6D-37A1-461A-91B0-DBDA5AAEBC99}\SHELLFOLDER")2a:T61a,".exe" queried SystemProcessInformation at 00011075-00003196-00000033-21496493487 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-40810909240 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-61434088437 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-81216243535 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-101726153162 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-122488916669 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-143233184072 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-163874661003 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-184695735422 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-205642057027 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-226767518505 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-247585764467 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-268527549589 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-289551657744 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-310278400896 ".exe" queried SystemProcessInformation at 00011075-00003196-00000033-3311753423822b:T798,"Hello, dear friend! ================================================= 1- [All your files have been ENCRYPTED!] Your files are NOT damaged! Your files are modified only. The only way to decrypt your files is to receive the decryption program. your files can not be decrypted without the special program we made it for your computer. ================================================= 2- [ HOW TO RETURN FILES? ] To receive the decryption program Write to our email "BigBobRoss@computer4u.com" and tell us your unique ID ================================================= 3- [ FREE DECRYPTION! ] Free decryption as guarantee. We guarantee the receipt of the decryption program after payment. To believe, you can give us 1 file that must be less than 1MB and we decrypt it for free. File should not be important to you! databases, backups, large excel sheets, etc. ================================================= 4- [ Instruction ] the easiest way to buy bitcoins is LocalBitcoins site. you have to register, click "buy bitcoins" and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins ================================================= CAUTION! please do not change the name of files or file extension if your files are important to you! Your unique ID : 385FF103" (Source: Read Me.txt, Indicator: "decrypt your files") "1- [All your files have been ENCRYPTED!]" (Source: Read Me.txt, Indicator: "files have been encrypted") "The only way to decrypt your files is to receive the decryption program." (Source: Read Me.txt, Indicator: "decrypt your files") "Hello, dear friend! ================================================= 1- [All your files have been ENCRYPTED!] Your files are NOT damaged! Your files are modified only. The only way to decrypt your files is to receive the decryption program. your file" (Source: 00011075-00003196-00000005-26986469044, Indicator: "decrypt your files")2c:T7a7,".exe" opened "C:\Users\%OSUSER%\Favorites\Links\cyworld.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\dailymotion.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\autohome.com.cn.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\bestbuy.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\facemoods.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\fileserve.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Contacts\%OSUSER%.contact" with delete access ".exe" opened "C:\Users\%OSUSER%\Documents\Database1.accdb" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\1616.net.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\17kuxun.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\360.cn.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\39.net.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\51.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\58.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\6.cn.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\726.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\95599.cn.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\abchina.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\adobe.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\alibaba.com.url" with delete access2d:T894,".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 552) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 552) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 552) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 368) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 368) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 368) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 524) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 524) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 524) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 540) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 540) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 540) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 276) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 276) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 276) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 512) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 512) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 512) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 340) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 340) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 340)2e:T66b,Spawned process ".exe" (UID: 00032966-00003872) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00034607-00004080) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00035618-00002256) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00036606-00001512) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00037603-00002140) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00038621-00003348) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00039634-00000596) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00040610-00002692) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00041602-00003540) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00042621-00003824) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00043617-00003536) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00044611-00002068) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00045594-00004024) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00046787-00003624) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00047620-00001688)2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790442911427,"unified_at":"2026-09-26T17:15:11.427Z","metadata":{"hashes":{"sha256":"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca","sha1":"279f1cd5a405a217fc2d99f8ddcdfa3fb0198008","md5":"3e6df41f4e8aa4d85f0d6ca7cf9f3069","sha512":"caac4a264c27f4866f8900d160c4eb243608452d0b7863b453944d99a72062fe083d58255fed3e5984e4ab47cb8a8dddbf554096cf684bab5108ac59d5772657","ssdeep":"24576:c0X5+IX92EUXYEjlh85e2Lyuj81aW9ZUXIPczB1S8CdaK9ElH7c0Z:nXAIX92BnBhme2L5g1FUIPcN1SLaKelh","ssdeep_chunks":["24576:c0X5+IX","24576:0X5+IX9","24576:X5+IX92","24576:5+IX92E","24576:+IX92EU","24576:IX92EUX","24576:X92EUXY","24576:92EUXYE","24576:2EUXYEj","24576:EUXYEjl","24576:UXYEjlh","24576:XYEjlh8","24576:YEjlh85","24576:Ejlh85e","24576:jlh85e2","24576:lh85e2L","24576:h85e2Ly","24576:85e2Lyu","24576:5e2Lyuj","24576:e2Lyuj8","24576:2Lyuj81","24576:Lyuj81a","24576:yuj81aW","24576:uj81aW9","24576:j81aW9Z","24576:81aW9ZU","24576:1aW9ZUX","24576:aW9ZUXI","24576:W9ZUXIP","24576:9ZUXIPc","24576:ZUXIPcz","24576:UXIPczB","24576:XIPczB1","24576:IPczB1S","24576:PczB1S8","24576:czB1S8C","24576:zB1S8Cd","24576:B1S8Cda","24576:1S8CdaK","24576:S8CdaK9","24576:8CdaK9E","24576:CdaK9El","24576:daK9ElH","24576:aK9ElH7","24576:K9ElH7c","24576:9ElH7c0","24576:ElH7c0Z","49152:c0X5+IX","49152:0X5+IX9","49152:X5+IX92","49152:5+IX92E","49152:+IX92EU","49152:IX92EUX","49152:X92EUXY","49152:92EUXYE","49152:2EUXYEj","49152:EUXYEjl","49152:UXYEjlh","49152:XYEjlh8","49152:YEjlh85","49152:Ejlh85e","49152:jlh85e2","49152:lh85e2L","49152:h85e2Ly","49152:85e2Lyu","49152:5e2Lyuj","49152:e2Lyuj8","49152:2Lyuj81","49152:Lyuj81a","49152:yuj81aW","49152:uj81aW9","49152:j81aW9Z","49152:81aW9ZU","49152:1aW9ZUX","49152:aW9ZUXI","49152:W9ZUXIP","49152:9ZUXIPc","49152:ZUXIPcz","49152:UXIPczB","49152:XIPczB1","49152:IPczB1S","49152:PczB1S8","49152:czB1S8C","49152:zB1S8Cd","49152:B1S8Cda","49152:1S8CdaK","49152:S8CdaK9","49152:8CdaK9E","49152:CdaK9El","49152:daK9ElH","49152:aK9ElH7","49152:K9ElH7c","49152:9ElH7c0","49152:ElH7c0Z","24576:nXAIX92","24576:XAIX92B","24576:AIX92Bn","24576:IX92BnB","24576:X92BnBh","24576:92BnBhm","24576:2BnBhme","24576:BnBhme2","24576:nBhme2L","24576:Bhme2L5","24576:hme2L5g","24576:me2L5g1","24576:e2L5g1F","24576:2L5g1FU","24576:L5g1FUI","24576:5g1FUIP","24576:g1FUIPc","24576:1FUIPcN","24576:FUIPcN1","24576:UIPcN1S","24576:IPcN1SL","24576:PcN1SLa","24576:cN1SLaK","24576:N1SLaKe","24576:1SLaKel","24576:SLaKelh"],"imphash":"c37d532b30fb638024ecd86590b4dd2f"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1204224,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1548069483000,"last_seen":1689272018000,"last_multi_scan":1689272018000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":15,"suspicious_count":15,"malicious_count":6,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Gen.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.1302","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.1302 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.NUB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Encoder.bhb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic Trojan.kp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.fmwnal","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"BigBobRossRansomware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Encoder.2924544","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.A05702E9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.A05702E9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.BOEQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Wacatac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder.Win32.585","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Encoder","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"$28","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$29","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"bestbuy.com.url\" has type \"data\"\n \"pagesjaunes.fr.url\" has type \"data\"\n \"bankofamerica.com.url\" has type \"data\"\n \"qunar.com.url\" has type \"data\"\n \"MSN Money.url\" has type \"Dyalog APL version 52.39\"\n \"cnn.com.url\" has type \"data\"\n \"linkedin.com.url\" has type \"data\"\n \"homedepot.com.url\" has type \"data\"\n \"y8.com.url\" has type \"data\"\n \"typepad.com.url\" has type \"data\"\n \"wikimedia.org.url\" has type \"data\"\n \"torrentz.eu.url\" has type \"data\"\n \"zynga.com.url\" has type \"data\"\n \"Read Me.txt\" has type \"ASCII text with CRLF line terminators\"\n \"cyworld.com.url\" has type \"data\"\n \"zhenai.com.url\" has type \"data\"\n \"ebay.co.uk.url\" has type \"data\"\n \"Tulips.jpg\" has type \"data\"\n \"tmall.com.url\" has type \"data\"\n \"mozilla.com.url\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"\n \".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db\"\n \".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\shdocvw.dll\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"5AppD*a;.Ie\"\n Heuristic match: \"[D2oo.Kp\"\n Pattern match: \"https://localbitcoins.com/buy_bitcoins\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca.bin\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.94096308862","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca.bin\" has a section named \"UPX0\"\n \"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca.bin\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"HAPUBWS.contact\" containing the Windows username \"HAPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\".exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2b","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2c","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"71119f007a3b9e00ab8b02007f950200fc8c0200729602006cc805001ecd9b007d269b00\" to virtual address \"0x774507E4\" (part of module \"USER32.DLL\")\n \".exe\" wrote bytes \"c0dfde771cf9dd77ccf8dd770d64df7700000000c011ca7600000000fc3eca7600000000e013ca76000000009457c57625e0de77c6e0de7700000000bc6ac47600000000cf31ca76000000009319c576000000002c32ca7600000000\" to virtual address \"0x77551000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca.bin\" (Offset: 37494)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"39/70 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"39/70 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"6h@fo.lw\"\n Pattern match: \"rgglb@wm.b\"\n Pattern match: \"3@o9y.yz\"\n Pattern match: \"3yvg@sl.b\"\n Pattern match: \"bigbobross@computer4u.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"DllHost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \".exe\" (UID: 00000000-00002792) was launched with new environment variables: \"LOGONSERVER=\"\\\\HAPUBWS-PC\", SESSIONNAME=\"Console\", HOMEPATH=\"\\Users\\U58Pbq6\", HOMEDRIVE=\"C:\"\"\n Process \".exe\" (UID: 00000000-00002792) was launched with modified environment variables: \"Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" (UID: 00000000-00002792)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \".exe\" (UID: 00000000-00002792)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"47/67 Antivirus vendors marked spawned process \".exe\" (PID: 2792) as malicious (classified as \"Trojan.Encoder\" with 70% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 552)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\wininit.exe\", Handle: 368)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 524)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 540)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 276)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 512)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 340)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2e","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]}]},"activity":{"stats":{"process_count":15,"spawned_processes_count":15,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":46,"dropped_files_count":0,"extracted_files_count":147,"files_written_count":651,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files","User Comment","TOR analysis","Multi-Process","Simulated analysis"],"sandbox_reports":[{"id":"61d8c5ca00ccc267563cba12","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Encoder","submit_name":"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca","analysis_start_time":"2022-01-07T23:04:35+00:00","indicators_count":{"informative":15,"suspicious":16,"malicious":5},"tags":["Multi-Process","Extracted Files","User Comment","Simulated analysis"],"is_in_unified_schema":true},{"id":"5d331b7d038838435a7f2d3f","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Encoder","submit_name":"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca","analysis_start_time":"2019-07-20T13:45:51+00:00","indicators_count":{"informative":9,"suspicious":14,"malicious":4},"tags":["Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true},{"id":"5c45a7ae7ca3e1045a3c1fa9","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Encoder","submit_name":"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca.exe","analysis_start_time":"2019-01-21T12:26:48+00:00","indicators_count":{"informative":10,"suspicious":16,"malicious":4},"tags":["Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true},{"id":"5c45a7ac7ca3e1052e28463a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Encoder","submit_name":"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca.exe","analysis_start_time":"2019-01-21T05:07:03+00:00","indicators_count":{"informative":13,"suspicious":16,"malicious":6},"tags":["Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}],"processes":[{"pid":3872,"ppid":0,"name":"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca.exe","command_line":"","sha256":"9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca","normalized_path":"C:\\9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca.exe","uid":"00032966-00003872","icon":"$2f"},{"pid":4080,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00034607-00004080"},{"pid":2256,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00035618-00002256"},{"pid":1512,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00036606-00001512"},{"pid":2140,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00037603-00002140"},{"pid":3348,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00038621-00003348"},{"pid":596,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00039634-00000596"},{"pid":2692,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00040610-00002692"},{"pid":3540,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00041602-00003540"},{"pid":3824,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00042621-00003824"},{"pid":3536,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00043617-00003536"},{"pid":2068,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00044611-00002068"},{"pid":4024,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00045594-00004024"},{"pid":3624,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00046787-00003624"},{"pid":1688,"ppid":3872,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00032966-00003872","uid":"00047620-00001688"}],"all_imported_dlls":["kernel32.dll","sspicli.dll","ole32.dll","apphelp.dll","api-ms-win-core-synch-l1-2-0.dll","propsys.dll","setupapi.dll","oleaut32.dll","shlwapi.dll","KernelBase.dll","rpcrt4.dll","Wldap32.dll","userenv.dll","devobj.dll","wow64cpu.dll","lpk.dll","nsi.dll","imm32.dll","shell32.dll","winmm.dll","profapi.dll","linkinfo.dll","user32.dll","ws2_32.dll","uxtheme.dll","cryptbase.dll","wow64win.dll","usp10.dll","clbcatq.dll","ntmarta.dll","wow64.dll","ntdll.dll","advapi32.dll","comctl32.dll","sechost.dll","cfgmgr32.dll","shdocvw.dll","msvcrt.dll","gdi32.dll","msctf.dll","rpcss.dll","IconCodecService.dll","WindowsCodecs.dll","comdlg32.dll","dwmapi.dll","version.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Read Me.txt","sha256":"5f131d5eb095401d79d8ed513b1805639c293ab603bcda6712b24b982a6b1554","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Maid with the Flaxen Hair.mp3","sha256":"1dc615200463de7de1dc6a69f023992e88efea5ac0d00ec334f13bba8069c514","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Sleep Away.mp3","sha256":"fb50c12fef34376044c48f4d4f838461f9a76e9397e04c299f61ae163a81805c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Chrysanthemum.jpg","sha256":"c39506c7d414ae966e24a75f7e8a69861111b189a052e6d6e7d348a0ca526021","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Desert.jpg","sha256":"1e0a632ef5221c7457f2c824e7e6817594acd37b98ea583bdab8cb214494188a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Hydrangeas.jpg","sha256":"b7b4a1d8dbb5ce86e4936695365d6997cf375dbf6aad7a663b6d1afccdff3c9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Jellyfish.jpg","sha256":"f08daadd6bd5ebac5aacb80d289aef9087eef3785969680d4e172d12d772763c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Koala.jpg","sha256":"5784a2953c1f6063fb0b07c944c3b196128f3d16105e0d418b752427841a17e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Lighthouse.jpg","sha256":"fc2f5faa55f72c2683cb59a2af3cc2dee0576511e7de85859feb7ad7db549513","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Penguins.jpg","sha256":"087f8555a33c0af89d48f5e0f64fca6cd8be39559113b1cd3035fc11161ba5f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Tulips.jpg","sha256":"0680014ad1b2d28a632d7c2caba30dff07257a87dc2c44d2d9f5c28cde32f8bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"HAPUBWS.contact","sha256":"1c208a5ea6550dda588efd9869e60122bb52db2fd9cb8a443ce0d800b6d05dda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Database1.accdb","sha256":"75d03c354b694c186b1aa223b142f8b45eec1503beeb4e14813035686b701a1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Outlook.pst","sha256":"513b09f80c667c045cdd34e3f89be68b7fb37b68ac225efce22b8a952fedd4ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"GobiernoUSA.gov.url","sha256":"032614f1bc1733accb3ee5d59a338d0fdc4f3030acc070f8b2d59bf0d9298b76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"name":"USA.gov.url","sha256":"5600ca37a9defa153a100e892c68e6b062920dc78ba9ce2577d76c6bb7012ac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"name":"1616.net.url","sha256":"da21bf2e76ab15be03dadad7c50c2b3377e85395f19de318ca5556c98df69727","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"name":"17173.com.url","sha256":"221615102e3c095c9c3c40c024e45ecd98ed6416527f5eedaafad41f6a781e83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"name":"17kuxun.com.url","sha256":"a446c5f84881b7084abb1e82f94ac4d3671bdad0e4b2adfc31181e6e016ebafa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"name":"3366.com.url","sha256":"d5eff1b54df87afaf5b58e60a395c8977f5c5056cbadb7b839ff40e2eeed1dda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"name":"Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt","sha256":"58c1511e1d410597a92c17b250cf82f9ea9b4438840b1fb40fb409bc1096a5de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"0NmJH6i8.gif","sha256":"08aa2c3eb693db65e36b7ea2ef6404deeac455fec76b0d7103f01014d1498e6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"0RER5x.txt","sha256":"31554bbacc575522192cc9c0e8c795639dbe06d8d86555f1b23d9672e4537be1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"0YdED8h4YnKljVf.doc","sha256":"f25847ac153b4a0a2c73a64922f5bbc316e9337caaeec17620e5f974ccf16f3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"0n7WBcx6F.rar","sha256":"211825dc73d25d9f1a9ee3e128cbefb10ee9852cfb401ab3284cb70995796199","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"10ybAbsXU.mp3","sha256":"2284c98c298efa30d8a816d5b1567ed8c27c2429014b15a8c36dde39bf35978b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"1LoWM7zNlVq8h.exe","sha256":"283a996372af61dab36c7bdf1b258db00b13d4ee66bd4fc35c370dcaf76f4369","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"3TXw.exe","sha256":"120b30db55dbdfa296ad2c9456e340c06e818564be9e9b4d5d4e806daa82450c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"3VBXaPVG.exe","sha256":"bdb44635555d2ffde5080d27db0436863d431af4aff492ebed93fd6148a32161","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"3kNG.exe","sha256":"cc87092c81b358e8048c79bbc08b0011bfbb3bf6f39d3bb7c44ca0fc679e9b1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"6JQvD1.exe","sha256":"4c0ee5ac80b839b5669e3eb0b63dc68e0b667ac81064622c9aaf195c35d03a8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"7GXTVgCwg.exe","sha256":"460d963859f77e75770236efde83e28658ac97faa43a5540d655efe7ae4cd96f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"A6a4k093.exe","sha256":"30fe95760267de273b35bd51107df90e926a97323048e7a1995cafaad3d7d38b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"AMrt2OL.exe","sha256":"3a943d5bada138e63875036053143cb15dc546dbd7bd2f51182c8be088578613","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"Byf3DiB7aX.doc","sha256":"97d0c9d6693e1f4ba2404ba5b16a0a7efb54b271972b6eb4d3a562660ee02d42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"CJ8ZksCqfYdg3Ha.exe","sha256":"8ff6a9f7f6b32fb649cb3386510551466c02ccf457b70c25f7bc66e16d49e1f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"CspyTJgM.exe","sha256":"0af1ec5d5ac2af13eec11977c0925cca67836c22aaf4c58b1dadb48145f61d76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"D1JACuX.exe","sha256":"5b811fefccacf4f6268167dc525ba99a75e004ed37261002c7c0033442a7cbf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"DP001GCJ.doc","sha256":"4e594dc968ed2e02b0f0cc3b5dc79243b7294b5ae3d9b1757e40032f6f3afce5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"DcNNjRAkEraNbP.doc","sha256":"e32d39cd29b43ed39528f1c9cc8b05c4aac23e430bff0e1f4fec80e56bc4bb1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"E68SD0Ky01dhTr.exe","sha256":"804d8195d4fe435bb6850ecd762acd9e158ff8a99d7a1d1d1a088002a362673a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"EW9C2p.exe","sha256":"ba59e9598ed428e16798dfc50e4e6358c890c25f5904abee3788a7787f448047","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"EatIg.exe","sha256":"9642cd12204bbd328cb4b2201d97b261cf29c7bbadd5c2cfe3923dbc3a610915","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"F3ECcNeSSZh2HHk.doc","sha256":"824730e10ea70bdb27a1dee323ce923aacc6d7def1a7abcac467159d6d315500","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"FjTsWkpkM.exe","sha256":"89abbb5a7bbea3f8f95292fc4a758cd98c9eda13af2084d64636a71b753b4da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"GuVY23qj2s4Td.doc","sha256":"a6c66f97bd1dc4ba744419e96c7d1ff521f9ff8371c482dab9de162d2c4ba00b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"H5uM4HShGf.doc","sha256":"d61281e42a65a0dcd7e901488a967b27752b84ec79e13811a4b3eff81afda04b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Ho7euGVfWh.doc","sha256":"2fc4219e1ba8e38fc71ad6619b7382374a4def5e95c203ae189dbe9a9104ff40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"HyhkV7STqOqjMtk.exe","sha256":"6afe9ee7be3022eaa235769b31e00f5f26159a3683a37778f955b0c71ab9c143","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"IOR7TqkslejAq91.doc","sha256":"87b08b4e749de2751cce154368615db6eb3580f63770dfa91f3f5b1398f32bd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"KQNwhwsYVN.doc","sha256":"6a117a74f7d36967b16b3d21b514a39e24d533c1433da1b72b124fa0c700a869","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Kty1hE.doc","sha256":"d493d8dab6d35d0a277251035c5115945efcd4fa5eec048af07d599d08886349","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"L8yloyiM6okRPgbd.doc","sha256":"26fc22ff741a52223c8d0f638a2b2963fd635ddcb8f9434e534e80fe822e4bc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"MCLvMmDoz8.doc","sha256":"0ab50674a3cf2adbd6e0886aa57e821cb228120c6407a3bead607b4366b83578","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"OCXh75SGcr7.doc","sha256":"291f473c7d220b6fbab92c63f819398ba19e9688f6d65501da0c180bfc7e9e00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"P7FflJbOH.exe","sha256":"4cca7786c3f1c48169993466d36d05fd7860b147ad73f59d206b748204c0c46c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"PaGnOfAFV.doc","sha256":"cbacf94c24b210cc0d6f5ee778060e378c8598a7b7f7d590203eeef8fc75129b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"QHqsY0rsfcKBMQe6.exe","sha256":"c4faa8af651298d63356494207de03f29d907b7cc3adc6b6936e8b8bd66be183","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"QOLdjWn5hr5.exe","sha256":"ce60ded70c915230dab7724f5d9f2432c8603b27af76ae455d83a99ffa3876c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"QZ0gLvBKm.exe","sha256":"fbba8d1cdf3f1c88a0e9115b369da2b14e7c514523135bd8eee2eeb03b57bbab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"QwHQtYTLWgvQ.doc","sha256":"68ad59cc52ca8c452185defa8074bcb2c60efeccce2de628a373e61901d9c12a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"RKnV.exe","sha256":"a5c7e045219950ed84f5b68f8efa2ea4260d9f04810a35d79382a5064ab8e565","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"SrO3gl0EN9SPZi43.doc","sha256":"f4da7708b6c5f6e9df01e478df39376bdd9cda36816e74afa18a245291194746","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"SvUAzGFIQ9qYfc.doc","sha256":"fc7af624b3415ec06860faaea03c17cbc2f8c1d97b810c3b791e6d33cfc8d824","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"THQujKln.doc","sha256":"3113fe411dd1d6098b72f2dba97bbf062359a503da6d399804f6a6dcdbf5b2ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"TTjDpaUqzIMaB0g.doc","sha256":"626a310922832cb8a1106dc2bfdfa20df106eaa00a0911628a590d3b68a196e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"VjguKL.exe","sha256":"c9a4e8836896aa000fa7e63ef5e4414a3fbf8c090b2658ec70f539164b5dfe99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"WHJUHaHxBnS.doc","sha256":"376d2f2d4bd83cbe4486f3b39728c1442c4bf611ac978cb0022ebfdd29093cc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"WbaQ7e.exe","sha256":"5212ad9a17f1ad09a6089937b40d70f1a81a84de4af5e580779a6a4c345a2e88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Y17hACr8qg.exe","sha256":"77b0769bd5a82d8fb3f4e32482f7d29afac2cfa55933cd602e1ad8dc1098c4d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"YfkuO.doc","sha256":"7cd310a02ce187331700e55ef24669bc3c69aff481bf041ac9361c21fb044ea7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"YjmF.exe","sha256":"3771af77fc2a2f3c0d744b500fb31bd3bbe2abdf48d1b22fde06319416995c2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"Z68C2t.exe","sha256":"c6c3b1b36050f9899e92ceb51377066622e05fbf553c029aff041283746f00da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"ZUwXv.doc","sha256":"70e9b67ef596a4c00aed50778d5c4b154a88b175976650044547175a588be225","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"ara0UGGW3VRU.exe","sha256":"d2c93054c4ec40f730aee9b64773299ba76dd0ee0e4fe481b4f46f2481df3ff7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"cUJpjDsZO.doc","sha256":"e0267d5584b800df10e422b706903f93fd06c8f094ff50a6af6518824415775a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"dSTEZHvd.doc","sha256":"ab33900122935d30b1e3d11c356804ab82277e12164ae5074908477fd9ff07ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"dsYny5bq4UJV.doc","sha256":"e19dcdb4b8c4bf4c0cef5a4c54b11abc8c702bb581303113d2644ab1048f32c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"fxlTZfcB.exe","sha256":"19dc28e507a67895bdc6c76552b3dc94b3942b3a99951f2109542de03797b526","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"g5pB3.exe","sha256":"42cdb3def38e034e35ea7d0fe485ecff2faa92b996965f43d0d22343c21eb963","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"gBiUJ4TRATi57.doc","sha256":"31554bbacc575522192cc9c0e8c795639dbe06d8d86555f1b23d9672e4537be1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"giDj6Q.doc","sha256":"3e2a89f8c405115dd2527191da7168f21e37f43a78d69aa6fe069fe6c670cfe2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"gmSsIkVXD.exe","sha256":"01ae49612cf1cbb5baa8d07305c9f36255aa2e2ca9420422da035faf5fa61f60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"h8fg9WRouk.doc","sha256":"16e4276825b911961c730abfcea26b9e41ac6fa8b82b5f6b218c80669dd09bf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"hgUOm8vUl.doc","sha256":"31042833c069f415ebdea6bd275ceaa44e4d531e9f43b3844f7edb71dde7d007","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"jLgQj5MNMjfkAYq.exe","sha256":"4174cbfc784ac60d3055c27fd2e84a2b5c718ceaa78ba76a8d55503b75e60689","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"jR4UhePpkWKtU.exe","sha256":"ecd899f834864f12c03f0e9277ecf49ea01de69f2f3358ae646f88f88ffc3c6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"kM4aPm1y.exe","sha256":"d28ecddd68ac8da32dd3e2d60ce48bf19a42f9ff31e2492d55aa4d19649b40b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"lKxIrwOivZM.doc","sha256":"a696adeed6f7391597b7e50e0f66738fcad74cfe99c5863b15cf2c839f4e14c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"mgF1qbnPMDZnVB.exe","sha256":"f8a2264f4b148a7da8e9ffd9fb124bf2ba1fe2d04892b2bf8691cde9058cef1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"oBqqx89Mp9N.doc","sha256":"0f32ff6176942e98d8d370a5cd6e373f23c77f86da5fa5eafa8c041dd17ef996","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"ppGWUpWSWorQZ.doc","sha256":"aa8f0670d776c300b697c1d5fbcccc4a99b44314d769074cb512e4bb2af337e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"rcKxZC.doc","sha256":"9d4f6a1014122f6031e2bae164a69734853c90b8eca129db1516da79bb1efc3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"sIz9IMypdNES8St.doc","sha256":"bf416ed3e066e702ceb521f6da0e0c280b5f4d4a266a02ae75489171e705feb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"uqmgQd.exe","sha256":"cec55df085fa1fd22eebbbbc7022397495589a2b7104b72782e305a26a315e9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"vaY7qXwkU.exe","sha256":"98b52d32bc30e76cf616f9e33f95bf1ca8acf0ac0d0fbbecc5c10d62ba2582de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"vsKespazw6mjoz.exe","sha256":"6050f0b8248eb812170ab0ed2177c42339ddf9fcd180242fdae31194bcf170ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"wSLQ.exe","sha256":"0c3c4beb48595fd7fcc960e690389406d83b8e5d851a3b469ba4fec85d85b1ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"xH1o63B9xkJUw.doc","sha256":"1df0a7263987dc039e58fa38900bc608ceb2d1e0e091d67d831f403c6cf26879","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"xUCCh60Kqg2.exe","sha256":"1c68d6ed98898ca683054311eee18608702c9e56938f521275c9692309a6f119","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"yDT9O.exe","sha256":"f2d2c8004d92807e64db2295566abc773f2879fb6e05e950534eb3a2828763db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"zIjQMqSEj24HleX.doc","sha256":"03093a836bb7c65a68da375aeb5abef2b6f4425477cf3e9edd0ffb8d79dbb8ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"name":"6TNRAzWB1pG3.txt","sha256":"8e621de386fad595a5f7ea2fd9c7747835cd666fd3f10abfe44de75a1308da61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"BeQ9kSwU5.rar","sha256":"9a8d21f7af1826c53c0616b0bd874376e71bd35245384e90d5f315bf37c8f52d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"AxkS3gH.txt","sha256":"ff7a693f54dd88b38b459f4a848d4cb5726f742286efab45c242ab195ec793f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"4atBAsCkzC.avi","sha256":"1a09bbcc70cce034c79c4b7fbbc18e7fb7b313dd9d2130bc7bdcd5c1db5eedb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"aoVwPqh5K.avi","sha256":"669be92321e045a26f4e749342630e3c2ecb67c9c6a9533e1586b82e8ee3ec9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"6rND.gif","sha256":"80b9d2c11495ecbfb24ac3b8b90e7176de594e9d0ce49c5b5344ddf872ad749a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"7A2w.gif","sha256":"d2f34a11d3e28c9f622f702b54055c5c8e65be17960f525dca9e6c14c21f045f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"59JuNefogVsL0apf.pdf","sha256":"ce02f8eedba5e55403510325b6cbe89edc34221ad099ddc96bb6e85a542b5f8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"5r3OOF8fnCr7PI.txt","sha256":"1ec94e01a6e802f2ae8c465a089c2560bdfc39ace60b8c9162e77ebcc170142f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"2NMIHXVwEkzB3.rar","sha256":"dd8e8b646de599f45f803eaebaa55f2d2532271525ec68c415359caf39acd405","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]},{"name":"PSPUBWS.contact","sha256":"958b0abe9d37d2eab6779d2b589fc7b53dccd1cebd00fc81c5a69fa2009e097d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"01dMtnkBz9.gif","sha256":"09bd9323038a673e85e8a48ba6804c2b6e8626cc395aaff13be82d7b36b6cdb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"04bZ.txt","sha256":"e02e41a5e638b693954f834a7ca1e8ac88bc23b63761a1f330e57d259d33aa79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"0Og1.rar","sha256":"58e0d85c51e74c15c465f44658bf7a61bbb094b1df69bb4d29707273b96b5362","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"a13736b297a85b33be66b9eccdb9d6a7fb9c57bf6fa32822ec69c469e4e631c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"1aa1094c63e5295d476778accd5d8239de790957aff71eb49d4f1291e44b3da4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"0zIG0D.doc","sha256":"cb0b3dd09e96e39729280a5d133d9e05f5fadf22c74046140e7ad88227866909","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"1N1A3vlRdYRii5C.mp3","sha256":"b62a05e032db0fdce5aafe372c20f61bc021e126be59ebbd0cb7589003ca9b8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"1q4yvQVxByym4.rar","sha256":"e3cf569277dde6efc42daafca7217d1dd49f3ba63f5daa6c6aecc8e16b87ec60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"3AVoUo9c20GI.pdf","sha256":"890b8d35380ed663a5b6ec11d7d286d1581674b65c953a33bd749de3127d86ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"3Awf.mp3","sha256":"d7d0b7cf93869507abf4d4af1c5f352ac1c950fa23d520beb2090a00c4224483","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"3dfFyhzUJVQSk.img","sha256":"3869596c27f488d63f9995003779cc7d16326d421c50686f921741da7240f191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"4lpro8p6KuJo0.mp3","sha256":"88d1689c61c99cb3e4d04ae5cb0c078c61389ca0758db5b3fc40ee7e589cfb8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"fee6995f602ece6464166c31d6c68f7e558852f802118c66eb0caf7ae696235e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"2f2324c0976bb0c1c85f8c70e832767da32bedf815223b3f3790fa660d504382","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"6SZfLTu9z.doc","sha256":"866070ad6978955f6126be8f1a82b64b48f81655bbc90ac023a0725c48dc4e49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"8df3102e20f0edbb37eac561724c0c6e3eddf19a3ef43bb767d33782d337937b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"a13f1dbca4d1b4083fa7880236c71c72f2bbb6db6431c99f9bc493c8af76a270","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"C04T72pR0Bcl.doc","sha256":"44d899f57173c72292fba122a0a1ff2672f24f9f47a8401187cd9a312f408d6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"EKeaJO.doc","sha256":"04621e4d79464f01e2428945ac56ee7e120ffb283bd4b254e229dd8182ec04aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"F3hzum1.doc","sha256":"c755058793d3804ccd716b49953b6391b61b4b474bf19ee91ba561d2b7c81cdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"a3Ntx.exe","sha256":"381772795df0f7aa88f1a79b56b5e503f75873efe19c8ac375401dd6759683da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"bg3oTe.doc","sha256":"d04f0a1fe74d2893feb8552e11e0984862411ed0503ab9f3e43acadced7452c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"bvYkKJ33N9A.exe","sha256":"622223a2268a47313f419ed464e275ebc3a317bc3b3bbaf4a81d0e91fdc9950f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"dH1rDN9f9.doc","sha256":"e7e4e022a0b96cb73eca325fee0356ef6cc6bf82798fd2b4c3ee979befb1fc39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"dgQJde60mPXhI.exe","sha256":"3b81e26b7ba66a9ba0cc20036eaaefb44228794030d4d3ebb3fb9913a00d82e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"dskCEJ.exe","sha256":"a997a911b7c33cd0a044b546253b81e38d46622c1450b2dd10b0c8da4678b015","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"hKY8.doc","sha256":"7b66376e4c823204bccdfa80ddffafec55e98732447960c17dac61cedd0e4759","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"hlchPBL.exe","sha256":"096d9b2ab3a26c468deaf6fe1509e9bfa9e6f06f18036a1e692ab23e00462889","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"iLLOga.exe","sha256":"17e46ea7669d83f8285529f28adbe72cce78451e37d9d0cc1041530d88fff192","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"kY01UeAiy5.exe","sha256":"574f5bf402af57192dfb89da82cd8d61d3152db59d006e65d36e530e4a5aa595","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"eaf30c9c715d5083f32217ecc19fda824c6f402b34e1793127061551a0901b13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"klmqz.doc","sha256":"cfd23cd276c394a94f6973c9f92cdf893c43a1af81db63bd36d173a8abee76bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"197fc1f21d135c326bb88312d48120970dfd3b39a1adfe15fa027c429cf4dbc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"name":"mtgFs8Za.doc","sha256":"97b365abd2bad596dcc47ee3827bce2b4275c153f765941d43f2ead358f7f676","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]}],"files_written":[{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Links\\Desktop.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dailymotion.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\autohome.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bestbuy.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\facemoods.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fileserve.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bitauto.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"C:\\Qt\\Qt5.8.0\\5.8\\static\\qtlogging.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Contacts\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Documents\\Database1.accdb","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Documents\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1616.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\39.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\51.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\58.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\6.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\726.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\95599.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abchina.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\adobe.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alibaba.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\allegro.pl.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Links\\OneDrive.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.de.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\accountonline.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alot.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\apple.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\att.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\answers.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\avast.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baixaki.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\msn.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bankofamerica.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\badoo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mywebsearch.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bbc.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mylife.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\biglobe.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nate.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bizrate.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netflix.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogspot.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\brothersoft.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17173.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\careerbuilder.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\chase.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\camzap.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\3366.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4399.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360buy.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\61.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\51wan.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\96pk.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\about.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\addictinggames.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\agame.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\chinanews.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnet.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alipay.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\allrecipes.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ameba.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\aol.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\asahi.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cntv.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cyworld.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Links\\Downloads.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\daum.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\babylon.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\depositfiles.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\discoverbing.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baidu.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\douban.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\scribd.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baixing.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\reuters.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\skype.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.de.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\so-net.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baomihua.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sears.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\exblog.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\expedia.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\skycn.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogger.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\booking.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\caixa.gov.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\capitalone.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ccb.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\china.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\clubpenguin.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnn.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cocolog-nifty.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dailymail.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dangdang.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dianping.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dell.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\docin.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\duowan.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ehow.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\exoplanetwar.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\facebook.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fedex.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\filestube.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\foxnews.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\funshion.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\google.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\groupon.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gyyx.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hexun.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\homedepot.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\flickr.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\foxsports.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\glispa.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gougou.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\guardian.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hatena.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hi5.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotels.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iminent.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\jiayuan.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huanqiu.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotmail.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ig.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hulu.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iegallery.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotfile.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hp.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kaixin001.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huffingtonpost.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\java.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ifeng.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imdb.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iciba.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\juegos.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kakaku.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kugou.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\letv.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ku6.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\leboncoin.fr.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\libero.it.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\macys.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\match.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livedoor.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livingsocial.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\marketgid.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livejournal.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yahoo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\linkedin.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\megaupload.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\lowes.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\live.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mcafee.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mercadolivre.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\metrolyrics.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\megavideo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsoft.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\monster.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsofttranslator.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mlb.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\moonbasa.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\miniclip.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.org.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mop.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\musica.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\naver.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nicovideo.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nextag.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nhk.or.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\narod.ru.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netlog.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nifty.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nytimes.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\odnoklassniki.ru.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nk.pl.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\onet.pl.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\norton.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ocn.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orkut.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\oyunlar1.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orkut.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orange.fr.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partypoker.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\okwave.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paipai.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pagesjaunes.fr.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partycasino.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pconline.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paypal.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\photobucket.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\people.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pog.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\priceline.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pogo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qunar.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qidian.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qq.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rapidshare.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rediff.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\renren.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\real.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rr.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\reference.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\samsung.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soku.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soufun.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\slideshare.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soso.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sogou.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sponichi.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\syyx.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sourceforge.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\surveymonkey.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\t-online.de.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\target.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\taleo.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sweetim.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tenpay.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\taobao.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tagged.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\szgla.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\terra.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tianya.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\thepiratebay.org.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tripadvisor.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tmall.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\torrentz.eu.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tudou.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tripod.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\twitpic.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tumblr.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\twitter.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ucoz.ru.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\typepad.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ups.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\uol.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\vancl.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verizonwireless.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verizon.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verycd.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\vimeo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\vkontakte.ru.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\walmart.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\weather.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\weather.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\webmd.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\whitepages.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wellsfargo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikia.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikimapia.org.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikimedia.org.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikipedia.org.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wo.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wowan365.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wushen.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\y8.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youtube.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yellowpages.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youdao.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\windows.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yfrog.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youku.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yandex.ru.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yahoo.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\xinhuanet.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wp.pl.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wordpress.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yzz.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zedo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zimbio.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zynga.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zhenai.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zoosk.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\USA.gov.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\IE Add-on site.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\GobiernoUSA.gov.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft At Home.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft At Work.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Money.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Autos.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft Store.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Entertainment.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Mail.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Get Windows Live.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Gallery.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSNBC News.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Sports.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Searches\\Microsoft Outlook.searchconnector-ms","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Chrysanthemum.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Penguins.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Desert.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Jellyfish.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Links\\RecentPlaces.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Spaces.url","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Searches\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Kalimba.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"C:\\share\\9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Sleep Away.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Hydrangeas.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Koala.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Lighthouse.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Tulips.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\Wildlife.wmv","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"C:\\share\\1548070026658$OK","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"C:\\share\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"},{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"C:\\share\\1548070026658$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5c45a7ae7ca3e1045a3c1fa9"}]},{"path":"%USERPROFILE%\\Documents\\Amazon Downloader Logs\\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Documents\\Amazon Downloader Logs\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Documents\\hancom\\Hancom Office 2010 SE (English Edition) - 3PC-1User (Download) Keys.html","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Documents\\hancom\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\0ERnyla.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\0NmJH6i8.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\0YdED8h4YnKljVf.doc","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\10ybAbsXU.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\1fTAJh.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\1oVe9N.rar","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\1X8T78.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Documents\\hancom\\HancomOffice.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\5CDRyD7pjBr.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\1F5WJj2.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\0dZxapFIdAxD.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\0n7WBcx6F.rar","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"},{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\35ZarnYhqsU.pdf","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\2AqafuW.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\4aSNKoffrEa.rar","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\2bQXToGMVxFT0.rar","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\5DvnwUIjh.img","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\59JuNefogVsL0apf.pdf","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\5b9arbo16G.img","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\5nNbK.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\5r3OOF8fnCr7PI.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\6AlN.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\651ACb.pdf","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\6kLuk5dbblP.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\6rND.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\6WgQy9WsWFcG.rar","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\7A2w.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\8EiaFDlB4M.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\88l94F73i.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\9C7DD5h4CqeNmZHy.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\A80f.doc","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\aae2WIzuLYXCjmg.img","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\aoVwPqh5K.avi","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\bRHj.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\bYhyR10yl.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\eeOm0.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\CJ8ZksCqfYdg3Ha.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\cReyCk.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\D6pHlz.avi","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\ancpyWMibIM3tcgy.doc","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\bt5SxSIb78V.img","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\CQR0Rz.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\C06c5p7.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\CGF5u.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\GlNNhzgomY0P.rar","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\DcNNjRAkEraNbP.doc","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\DuDiXsH.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\F3ECcNeSSZh2HHk.doc","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\j5vSsyC5hyVbxcUE.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\ej29hiIgu.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\FjTsWkpkM.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\fSByS62OIgz9do6.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\fxlTZfcB.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\g5pB3.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\G4mMIPVUG.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\HGeyHQzvp.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\hljT8RPYe1lQ.img","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\HyhkV7STqOqjMtk.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\htAQ1qHW9d.img","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\I2j6w.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\IeL34GqwIkYh2u.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\Idv1CI6UJ7vSTM.img","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\iKIJOOa.rar","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\in36xFEKKvTO.doc","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\J5crtYZWf.pdf","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\JsjU.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\KansQiz.pdf","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\l0jilrrWE.doc","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\JXiqpMf.avi","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\kBdOo0Pn553J.rar","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\kM4aPm1y.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\lgxFqNK49c4v.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\lKxIrwOivZM.doc","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\mDDs9WyW.doc","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\lmKtgIjh3n8Ctg.pdf","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\Lu5BVFK.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\mzQ68f3.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\NAJO79yhx.img","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\nFiA.avi","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\nr5rlsXbGB.pdf","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\nr0t5BWt3jWhvYn.img","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\Nuo7.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\o3arG2g8N.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\olW8MvTIqX8n5.txt","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\Of0iIqSzzrTMYx5R.rar","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\OWrdqhbs0th.pdf","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\ONhfqUEnYbDexIZ.img","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\P37ptIrU.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\p9qp.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\TICane9.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\u5xyw5YRu4.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\uEn5dB0f.pdf","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\RkATupP1.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\sFlzVX6KL.avi","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\SK5kSBFk.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\skIRXdxtDZ.jpg","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\sQZaA8HEtZ.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\T7tQCa.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\TBaq.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\TR4Vsi5Dwuzjrql.rar","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\u1ygbOcPETWrQr.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\TTjDpaUqzIMaB0g.doc","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\uIdNT2RyY.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\uqmgQd.exe","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\uiLhnxLq5CYjy.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\Uw5DJN81k.avi","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\uZUJptoFt.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\VdvHgdh.pdf","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\VNK18pD0d1HeRuBC.gif","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"%USERPROFILE%\\Downloads\\VMunI34LjdWN.mp3","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"C:\\share\\1563630364868$OK","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"C:\\share\\1563630364868$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5d331b7d038838435a7f2d3f"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Desktop background.png","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\01dMtnkBz9.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\04bZ.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\07Y08HBp.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\0cuxPf1k3pJ5.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\0gakl8ixtWMkw.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\0Og1.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%WINDIR%\\System32\\notepad.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"C:\\bg.png","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\0pYWspjURe8aqA.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\0zIG0D.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\1N1A3vlRdYRii5C.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\1q4yvQVxByym4.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\2Gd1Iqvl2kr.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\2l36bsgulx.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\3AVoUo9c20GI.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\3Awf.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\3bvjbrQlfgjI.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\3dfFyhzUJVQSk.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\3Fbc.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\4lpro8p6KuJo0.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\4nAn3p.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\4Pmmh3HlYKPz20b.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\5aFd8vA3PE3A.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\5F1yaAIKfUGQcmmt.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\5L9Wjn.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\5yqb2pxbZ.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\63sDzrkUoHoRT.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\66u5Ps.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\6aAIiUIf.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\6MR6.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\6SZfLTu9z.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\6WMjwc1zqk3IB.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\72oNcVyHs8NBv.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\7OxVHBv.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\7ZOfXpturAqbd1c.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\86iRpMfVS9o.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\8AuppwJ6wyt.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\8P9o.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\8Uu9ETpS.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\8xCKPsTPqAt0jj.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\9rNtWnjTq9RGbU.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\a3Ntx.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\A62zUUbY5QfVGXz.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\acZ9pR3WMOxAcq.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\aGAui.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\AL0XySsN7H7ugY.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\ar6cEZyyC.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\aXokYfum1LR9T.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\B2OE.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\b2v3n4eKoIDN.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\b6YuNbiDI.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\b9UD.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\BAa8xnBv7K.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Bcni29.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\BcZL4pkMX.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\bg3oTe.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\BK8vDj5a.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Bp9aBvvt.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\bvYkKJ33N9A.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\bwI55TdR2ltk57l.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\C04T72pR0Bcl.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\C3cps.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\caic.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\CEyeFINKwFDkgE0O.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\CflGlvefKCtC99t.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\CoCzQ91sOnv8.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\CjIBD.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\cTJXfHRYBCf7lK.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\czGQ8bl3v.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\d71boA.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\daTAwNa1cRBbYO.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\DgLGRP4C041.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\dgQJde60mPXhI.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\dH1rDN9f9.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\dskCEJ.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\DZ1I0FX.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\e8x938q.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\ecazG0z.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\EKeaJO.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\EIy4cIf3Sw.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Ery9w7qA.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\EvKbuCze.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\F07QalpWC.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\F3hzum1.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\fhjb3frndmupmzw.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\fkHEBb1SV.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\FksnKO3nPLqbqw.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\fnHklmDjE.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Frajmn2m7RI.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\FYmHKtcQNYS.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\G5IM1lDtK.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\G77JSgcmPf5H.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\gd7HlA2D90jF.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\gfoMPUZ1UQ.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\GgPR9V5hPE8bUpO.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\GiF6iC5.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\GnHuSl.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Go5opN9UMnRhwZ2o.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\gsHQMZi.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Haiz.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\HCCQmDcSMR.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\hCmeX1Ct3FFL6dk.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\hKY8.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\hlchPBL.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\HopLI4qUY5lj.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Hqee3DDn6LduWwwM.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\hsQjJvLaP.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Hyea.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\hZbsHrgo8ONOWmd.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\iEcMz.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\ieWzhDO3EIpCT.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\II5yrap9K.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\iLLOga.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\inloR0L.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\irQRC1fyB.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\iwIAg.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\IXWAmgM.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\J0j8.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Jdc9FtOxiP1gc.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\jDJAedKZ.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Jm34QKUSbOJ.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\JOq8Wlewlk.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\jU7uBI8eoGj.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\K6ok91lNINFU2.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\k9rCVCf.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\kdo6iAicsoicvHg.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\kDy3FUkn.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\kflWy2jLEiUoTUBN.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Kin7.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\klmqz.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\kY01UeAiy5.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\kYjkX0S1jo7Zm.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\kYSsy3IT.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\KYu5soC0W7AqbGh.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\lCEf83Wf7e4nuIMk.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\lcwvnk.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\LfRe1UstxS6dMj3.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\lg7Kv3Y5aqGhf94.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%WINDIR%\\System32\\en-US\\notepad.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\lGzEUcaAA.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\lM74.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Desktop\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\M89doZVhROC.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\MCnPJFRa.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\MD5t.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\MElB1FKqC2cxb6AE.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\Mfc8nmRBfzSVE.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\mj3KeUe3LBSMv2Dp.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\MqbmYiJCv9FZI.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\MRed6R.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\ms6h2c.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\mtgFs8Za.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\MZGXda99O.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\NhFS3OvQ4RI.img","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\NKqc2EyBDA.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\NOR3aMm.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\nptZgkCVl0OD.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\nWXR.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\o7AcVCKw0erZg.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]},{"path":"%USERPROFILE%\\Downloads\\obSP1kkndHWX46p.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7ac7ca3e1052e28463a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYSTORE\\CACHE\\S-1-5-21-2092356043-4041700817-663127204-1001\\","sources":[{"report_type":"sandbox","report_id":"61d8c5ca00ccc267563cba12"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["61d8c5ca00ccc267563cba12","5c45a7ae7ca3e1045a3c1fa9","5c45a7ac7ca3e1052e28463a","5d331b7d038838435a7f2d3f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Encoder Sample 9abf83adb634… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9abf83adb634…. Malware family: Trojan.Encoder. Threat score 100/100. 18/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Encoder Sample 9abf83adb634… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9abf83adb634…. Malware family: Trojan.Encoder. Threat score 100/100. 18/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9abf83adb634aa4ae2acaa96ce3c636e68e946cd13d69d08975ff8c2840991ca"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Encoder Sample 9abf83adb634… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9abf83adb634…. Malware family: Trojan.Encoder. Threat score 100/100. 18/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]