24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T440,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 9c02e9b35cdb… — Score 94/100 — Hybrid Analysis","description":"Malicious verdict for sample 9c02e9b35cdb…. Threat score 94/100. 0/28 AV engines flagged this file. 4 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9c02e9b35cdbc100d63350a1e85220e70a8b37ca7c7b5b37a34bb5c215b515ae","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","9c02e9b35cdbc100d63350a1e85220e70a8b37ca7c7b5b37a34bb5c215b515ae"],"about":{"@type":"SoftwareApplication","name":"Verify Your PayPal in Record Ti - Carlos Arteaga Jimenez.pdf","applicationCategory":["pdf"],"identifier":"9c02e9b35cdbc100d63350a1e85220e70a8b37ca7c7b5b37a34bb5c215b515ae","additionalType":"Malicious sample"},"threatScore":94,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T48d,Object ID 40 contains compressed stream data: No filters Object ID 44 contains compressed stream data: No filters Object ID 49 contains compressed stream data: No filters Object ID 53 contains compressed stream data: No filters Object ID 56 contains compressed stream data: No filters Object ID 59 contains compressed stream data: No filters Object ID 65 contains compressed stream data: No filters Object ID 70 contains compressed stream data: No filters Object ID 75 contains compressed stream data: No filters Object ID 80 contains compressed stream data: No filters Object ID 86 contains compressed stream data: No filters Object ID 91 contains compressed stream data: No filters Object ID 98 contains compressed stream data: No filters Object ID 103 contains compressed stream data: No filters Object ID 108 contains compressed stream data: No filters Object ID 113 contains compressed stream data: No filters Object ID 117 contains compressed stream data: No filters Object ID 121 contains compressed stream data: No filters Object ID 126 contains compressed stream data: No filters Object ID 130 contains compressed stream data: No filters26:T6a1,"iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF0493823ECC0B15DA.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF53F0F452AF32149E.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF732376FE1C322D41.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFE32DA9301E2FC189.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFEC64B0C2D55BB1F7.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF8DA5AB07006D5C7A.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF0FD11B13B07D92E9.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFE532BD02950233C8.TMP" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\CabFDB.tmp" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\TarFDC.tmp" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\KnoC91.tmp" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\JavaDeployReg.log" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\CabCF77.tmp" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\TarCF78.tmp" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\CabE77D.tmp" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\CabE77F.tmp" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\TarE77E.tmp" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\TarE780.tmp" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\CabEA02.tmp" "iexplore.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\TarEA0D.tmp"27:T43c,"\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "IESQMMUTEX_0_208" "Local\_!MSFTHISTORY!_" "Local\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!" "RasPbFile" "{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCOOJGAPIAAAAA" "Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!" "Local\WininetConnectionMutex" "Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "Local\WininetStartupMutex" "Local\WininetProxyRegistryMutex" "DBWinMutex" "Local\Acrobat Instance Mutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCOOJGAPIAAAAA" "\Sessions\1\BaseNamedObjects\Local\Acrobat Instance Mutex" "\Sessions\1\BaseNamedObjects\DBWinMutex" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!"28:T68c,"7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" has type "data" "01B16CDBADE7DB774141D7E30D50EC69" has type "data" "F5F320A94D4D2B4465D8F17E2BB2D351_9B58E6A0DF94D833DF2DBB3558E30FEB" has type "data" "Mastercard-2018-Updated-Net_[1].png" has type "PNG image data 500 x 319 8-bit/color RGBA non-interlaced" "F5F320A94D4D2B4465D8F17E2BB2D351_D87AB72AFD41327FE27102668732EE67" has type "data" "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data" "A9R1A1D.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)" "merged-2497ac6f5ef6a21f7bcb02667ded861e-min[1].css" has type "ASCII text with very long lines with no line terminators" "sample-bg[1].jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 2000x1418 frames 3" "CabE77F.tmp" has type "Microsoft Cabinet archive data 50939 bytes 1 file" "known_providers_download_v1[1].xml" has type "XML 1.0 document ASCII text with CRLF line terminators" "TarEA0D.tmp" has type "data" "merged-f67211d576610f6e6f40db1565e7f56e-min[1].js" has type "HTML document ASCII text with very long lines with no line terminators" "fr[1].htm" has type "HTML document UTF-8 Unicode text with very long lines" "CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821" has type "data" "assets-180822221925Z-119467" has type "PNG image data 48 x 48 8-bit/color RGBA non-interlaced" "mem8YaGs126MiZpBA-UFVZ0f[1].eot" has type "Embedded OpenType (EOT)" "94308059B57B3142E455B38A6EB92015" has type "data" "KnoC91.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators" "TarE780.tmp" has type "data"29:T4e7,"iexplore.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "iexplore.exe" touched file "C:\Windows\System32\oleaccrc.dll" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "iexplore.exe" touched file "C:\Windows\System32\rsaenh.dll" "iexplore.exe" touched file "C:\Windows\System32\en-US\urlmon.dll.mui" "iexplore.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "iexplore.exe" touched file "C:\Windows\System32\msxml3r.dll" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low"2a:Tf40,"m)/ModDate(D:20150223135645-05'00')/Producer(calibre 2.11.0 [http://calibre-ebook.com])/Title(Verify Your PayPal in Record Time!)>>endobj106 0 obj<>/Border[ 0 0 0]/Rect[ 344.468100 766.270900 449.015200 782.835000]/Subtype/Link>>endobj107 0 obj<>/Border[ 0 0 0]/Rect[ 424.126800 366.571300 551.245600 383.135500]/Subtype/Link>>endobj108 0 obj<>endobj109 0 obj<>endobjxref0 1100000000000 65535 f 0000000015 00000 n 0000000286 00000 n 0000000361 00000 n 0000001155 00000 n 0000076170 00000 n 0000076330 00000 n 0000076426 00000 n 0000076465 00000 n 0000076504 00000 n 0000076711 00000 n 0000076923 00000 n 0000077066 00000 n 0000077503 0" (Indicator: "paypal") "" id="W5M0MpCehiHzreSzNTczkc9d"?> application/pdf Verify Your PayPal in Record Time! Carlos Arteaga Jim" (Indicator: "paypal"), "nez 2015-02-18T17:00:00-05:00 en 2018-08-22T15:20:06+07:00 2018-08-22T15:20:06+07:00 B00TU380DM mobi-asin Verify Your PayPal in Record Time! Arteaga Jim" (Indicator: "paypal"), "m)/ModDate(D:20180822152006+07'00')/Producer(calibre 2.11.0 [http://calibre-ebook.com])/Subject()/Title(Verify Your PayPal in Record Time!)>>endobj110 0 obj<>endobj113 0 obj<>endobj114 0 obj<>/Font<>>>/Fields[]>>endobj115 0 obj<>streamH" (Indicator: "paypal"), "VERIFY YOUR PAYPAL ACCOUNT IN RECORD TIME" (Indicator: "paypal"), "/C/VerifyYourPayPalinRecordTi-CarlosArteagaJimenez.pdf" (Indicator: "paypal"), ""C:\VerifyYourPayPalinRecordTi-CarlosArteagaJimenez.pdf"" (Indicator: "paypal")2b:Tc52,"AcroRd32.exe" wrote bytes "4053c0775858c177186ac177653cc2770000000000bf56770000000056cc5677000000007cca5677000000003768da756a2cc277d62dc277000000002069da750000000029a6567700000000a48dda7500000000f70e567700000000" to virtual address "0x77DF1000" (part of module "NSI.DLL") "AcroRd32.exe" wrote bytes "7739be7779a8c277be72c277d62dc2771de2bd7705a2c277c868c17757d1c877bee3bd77616fc2776841c0770050c07700000000ad371c768b2d1c76b6411c7600000000" to virtual address "0x75751000" (part of module "WSHIP6.DLL") "AcroRd32.exe" wrote bytes "92e6bd7779a8c277be72c277d62dc2771de2bd7705a2c277bee3bd77616fc2776841c0770050c07700000000ad371c768b2d1c76b6411c7600000000" to virtual address "0x75221000" (part of module "WSHTCPIP.DLL") "AcroRd32.exe" wrote bytes "c4ca567780bb5677aa6e57779fbb567708bb567746ce567761385777de2f5777d0d9567700000000177939764f9139767f6f3976f4f7397611f73976f2833976857e397600000000" to virtual address "0x69551000" (part of module "MSIMG32.DLL") "iexplore.exe" wrote bytes "e92e0d39f9" to virtual address "0x7652CF42" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e99cf337f9" to virtual address "0x7653E869" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9395455f9" to virtual address "0x763693FC" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "7739be7779a8c277be72c277d62dc2771de2bd7705a2c277c868c17757d1c877bee3bd77616fc2776841c0770050c07700000000ad371c768b2d1c76b6411c7600000000" to virtual address "0x75751000" (part of module "WSHIP6.DLL") "iexplore.exe" wrote bytes "e9efb9c8fa" to virtual address "0x74C3388E" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e954a13af9" to virtual address "0x76513B7F" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e99ac36af8" to virtual address "0x77212694" (part of module "COMDLG32.DLL") "iexplore.exe" wrote bytes "92e6bd7779a8c277be72c277d62dc2771de2bd7705a2c277bee3bd77616fc2776841c0770050c07700000000ad371c768b2d1c76b6411c7600000000" to virtual address "0x75221000" (part of module "WSHTCPIP.DLL") "iexplore.exe" wrote bytes "4053c0775858c177186ac177653cc2770000000000bf56770000000056cc5677000000007cca5677000000003768da756a2cc277d62dc277000000002069da750000000029a6567700000000a48dda7500000000f70e567700000000" to virtual address "0x77DF1000" (part of module "NSI.DLL") "iexplore.exe" wrote bytes "e9b9431bf9" to virtual address "0x76503B9B" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9b34b29f9" to virtual address "0x764EEC7C" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9fc79befa" to virtual address "0x74CD7922" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e9e9f037f9" to virtual address "0x7653E9ED" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e96ff137f9" to virtual address "0x7653E9C9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e937f237f9" to virtual address "0x7653E963" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "c4ca567780bb5677aa6e57779fbb567708bb567746ce567761385777de2f5777d0d9567700000000177939764f9139767f6f3976f4f7397611f73976f2833976857e397600000000" to virtual address "0x69551000" (part of module "MSIMG32.DLL")2c:T4e5,Found malicious artifacts related to "93.184.221.240": ... File SHA256: 75ed7c1ca3d2aaffb6f9c7c63a8a304551a80435dcc118b43297d8b80c429f7e (AV positives: 52/68 scanned on 08/22/2018 14:25:14) File SHA256: 2df21dd07a48a40a0f42b19a316d63f690af97dcc49689d21f82c7b74125b829 (AV positives: 44/68 scanned on 08/22/2018 14:24:59) File SHA256: 6788408104b424d1bdba9e775051ffc9ad7c331b5bdf9bd5e45e2d66c5d9ffac (AV positives: 60/68 scanned on 08/22/2018 14:08:58) File SHA256: 8b71d9610c932246e32a29cb18dce4fd615ba199ddac5883c9966630f3b868bf (AV positives: 14/68 scanned on 08/22/2018 14:08:31) File SHA256: 6adf9d0784546d31e63fac9d57ba8862d7d26bedad66a25dd8bd6505592e2c35 (AV positives: 43/68 scanned on 08/22/2018 13:31:54) File SHA256: eaaee45bf9a9f3ea52b44db4b2e6608013b8cdb603f48f0fb08704421183db28 (Date: 08/22/2018 15:22:36) File SHA256: 71c6f65e85b035637969c77e47726fc2b4519a7738337314516e2c5fc86e44b4 (Date: 08/22/2018 15:19:33) File SHA256: 67f761c92baf50e4e51639d0ca57563fca838c67ffd607984a5b524e7849c11e (Date: 08/22/2018 15:16:39) File SHA256: e73aa4f81a656a870fd24bc58e8d77fcfb47262f4629b30a1d92adbc57e26306 (Date: 08/22/2018 15:04:31) File SHA256: 40db7ed919778d630ac4a553d4254958cdb3c4c47ff9350c6b8f89a5b67fe75c (Date: 08/22/2018 15:03:34)2d:T580,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD50lEQVR42u2VX2hTVxzH7x5cCzMVBpv/Ft2YqJ1FfJgMR2Ev/nkdjO1hK2OD7WGMwlaFakVRoSBUTdgWS60b6/ZgF+ymsxtrWpTF1eSmrcVq09iypK35K02Ttun/P1/P78iJ597m1l7Fl7EffLg5ufeez/f8zs2Novxfy6xYLIZoNIpIJMIJh8NZaEznCLouHo/zz/39/XjsxJde3Y5nwcDAAPx+Pz+WlpYaB6nfWITf39qtofWL/Rx53PLuR4uuM4LmDIVC8Hg8oKJOGIaos76BCxuKNIhK+QNoKNqVHQcvXtacp9LfS9CcwWAwG4CKOpEzwLlXtuLnDds0UNFx0HUVt2xn+dj1wSfIhCO4UVaRPW8EzSl3QFRvb+/iEN+s24wfWGIZKueuPUiyDqjHT/Ixfd9pc3Dk0t9L0JwUwOv1Ql/0XGgCVK3dhBqWWEbU7e9/yo7pGPX4cO3rQ3x85f2POfp7CZqT9r2jowNOpxN2ux0OhwMulwsjIyPo6el5FKJyzetwrN+igUo/prp1vi7neT00J+05tbyxsRG1tbU8RGVlJWw2G/+pZgMcWf0a7KxlS3HxvRJUb33zsdcJaE4KkEgk+FYEAgF0dXVBVVW43W7tNpS/tBHPgsHBQQwPDyOVSnHS6TSSySR/adGLKhsgPz8fFotlSfLy8uDz+Ti0CvFZ0NbWBvdzK3B9cyE8ZQfQ3d3N34SynPZ+dHSUMzY2BtOvYmqpEbTaTmUFAl/tR9/ph3s8NDTExbnkmUzGfABqnxHU6juWF9GzbQdiV/7QiHPJx8fHzQcgiRHU5ttvvwOVdSFx/Z+cYln+RAHEfuoRq71bXgG38ryhWMgnJiY4pgMIkR6xWn/5YbiUPPxbfS6nWMgnJyc5pgMIkYxYKfGX5WU0WzehiZFmPzW9WJZPTU2ZDyDL9C3uPHgEv1lWI3rDi1/ZsfXDTw3FxPT0tPkAQqZvb4qt9hfLGrQfOsalEY+KC2x8qWgn+pwNHPXwCdyssiPma+fymZkZ8wGEUG4toTJxvXULIl4fvBXHcbl4D2qUFzjVjLPKSvxoLURTyWfsn7IQoeZrmJ2dNR9AlorWhpnUwQREQ/FetFacQLCpBaPxBG91qPkq/iz5HDXsL7pKscBesB6R9puYm5szH0Dez3QsjpYvy3CGTVpfvC+7t2J/BdRqglZMZIaSXD4/P28+gHiI7qnt+I618jRbDXH/bl9OqSwmqRATCwsL5gMIwRnWzqNKAaettk4jlKVGYoLKdAAhOFZgRbmyCn+f+naRUJYaiUWZDqAXLSWUpXrxEweQRbmEy5E+VYClZMuVPlWA/2w9ABLzyQHF53sTAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9c02e9b35cdbc100d63350a1e85220e70a8b37ca7c7b5b37a34bb5c215b515ae","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":94,"unified_at_epoch_ms":1790545119210,"unified_at":"2026-09-27T21:38:39.210Z","metadata":{"hashes":{"sha256":"9c02e9b35cdbc100d63350a1e85220e70a8b37ca7c7b5b37a34bb5c215b515ae","sha1":"5c8b4e66e92067f462dbf4162f0c7375f67d64a5","md5":"cc0bbe89339d023b9f9945d4326a37f0","sha512":"f26a386d20ddcbbb7c156f47f6834a1fdd65d1c2e231717372379fa49402cebdae0189e3996ce2b2bbedfc8c4eeb5c34f766f332b152ffb499c331779f644eb7","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Verify Your PayPal in Record Ti - Carlos Arteaga Jimenez.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":1032820,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1534947642000,"last_seen":1649735497000,"last_multi_scan":1649735497000}},"detections":{"summary":{"verdict":"malicious","score":94,"tags":["pdfdrop"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":5},"sandbox_signatures":{"informative_count":26,"suspicious_count":2,"malicious_count":4,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Initial Access","technique":"Spearphishing Link","attack_id":"T1192","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1192","identifiers":[{"type":"malicious","value":"PDF file has an embedded URL referencing an executable file"}],"sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"tactic":"Defense Evasion","technique":"DCShadow","attack_id":"T1207","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1207","identifiers":[{"type":"informative","value":"Contains object with compressed stream data"}],"sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"iexplore.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"pspubws@www.neteller[1].txt\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/58 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.neteller.com\"\n \"www.skrill.com\"\n \"ocsp.pki.goog\"\n \"fonts.gstatic.com\"\n \"fonts.googleapis.com\"\n \"crl.pki.goog\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"184.30.208.161:80\"\n \"184.30.208.161:443\"\n \"93.184.221.240:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Contains object with compressed stream data","description":"$25","origin":"Static Parser","mitre_attack_id":"T1207","relevance":10,"id":"static-66","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$26","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$27","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"RCXC428.tmp\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00024710-00002508)\n Launches browser \"iexplore.exe\" (UID: 00024760-00003588)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"PDF contains no significant text data on the first page(s)","description":"The input has no visible characters on the first 5 page(s)","origin":"Static Parser","relevance":5,"id":"static-70","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"PDF file has an embedded URL","description":"\"http://gmail.com\" (Based on: \"VerifyYourPayPalinRecordTi-CarlosArteagaJimenez.pdf.bin\")\n \"http://www.neteller.com\" (Based on: \"VerifyYourPayPalinRecordTi-CarlosArteagaJimenez.pdf.bin\")\n \"http://www.neteller.com/\" (Based on: \"VerifyYourPayPalinRecordTi-CarlosArteagaJimenez.pdf.bin\")","origin":"File/Memory","relevance":3,"id":"string-25","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00024710-00002508) was launched with modified environment variables: \"PATH\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AcroRd32.exe\" searching for class \"AdobeAcrobatSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeReaderSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for window \"_AcroAppTimer\"\n \"AcroRd32.exe\" searching for class \"Acrobat Instance Window Class\"\n \"AcroRd32.exe\" searching for class \"ACROSEMAPHORE_R11\"\n \"AcroRd32.exe\" searching for class \"JFWUI2\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"-nohome \"http://www.neteller.com/\"\" (UID: 00024710-00002508)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2508 CREDAT:79873\" (UID: 00024760-00003588)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"-nohome \"http://www.neteller.com/\"\" (UID: 00024710-00002508)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2508 CREDAT:79873\" (UID: 00024760-00003588)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 832)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"iexplore.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://gmail.com\"\n Pattern match: \"http://www.neteller.com\"\n Pattern match: \"http://www.neteller.com/\"\n Pattern match: \"http://calibre-ebook.com\"\n Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"\n Pattern match: \"www.neteller.com\"\n Pattern match: \"www.skrill.com\"\n Heuristic match: \"fonts.gstatic.com\"\n Heuristic match: \"fonts.googleapis.com\"\n Pattern match: \"https://ieonline.microsoft.com/#ieslice\"\n Pattern match: \"http://go.microsoft.com/fwlink/?LinkId=121315\"\n Pattern match: \"http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight\"\n Pattern match: \"http://www.bing.com/favicon.ico\"\n Pattern match: \"http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$2a","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"merged-ddbedf6b8792bfd3f4a7fbdc865ebe6b-min[1].js\" contains indicator \"document.getElementById\" (Line: 1; Offset: 13689)","origin":"Binary File","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"CabE77F.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"CabFDB.tmp\" has type \"Microsoft Cabinet archive data 53978 bytes 1 file\"\n \"CabEA02.tmp\" has type \"Microsoft Cabinet archive data 54153 bytes 1 file\"\n \"CabCF77.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"RCXC428.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"iexplore.exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 832)\n \"iexplore.exe\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 832)\n \"iexplore.exe\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 832)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1Accept: */*Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Accept-Encoding: gzip, deflateHost: www.neteller.comConnection: Keep-Alive\"","origin":"Network Traffic","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Document analysis contacts a domain","description":"Often seen on documents with macro droppers\n embedded files or exploits","origin":"Indicator Combinations","relevance":3,"id":"summary-1","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"level":"malicious","category":"Unusual Characteristics","name":"PDF file has an embedded URL referencing an executable file","description":"\"http://gmail.com\" (Indicator: \".com\", Based on: \"VerifyYourPayPalinRecordTi-CarlosArteagaJimenez.pdf.bin\")\n \"http://www.neteller.com\" (Indicator: \".com\", Based on: \"VerifyYourPayPalinRecordTi-CarlosArteagaJimenez.pdf.bin\")","origin":"File/Memory","mitre_attack_id":"T1192","relevance":3,"id":"string-53","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 6 domains and 6 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":66,"imported_dlls_count":139,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":450,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":18,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":18,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":6,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["pdfdrop"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5b7d71397ca3e133077a4f53","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":94,"contacted_countries":["EU","USA"],"submit_name":"Verify Your PayPal in Record Ti - Carlos Arteaga Jimenez.pdf","analysis_start_time":"2018-08-22T15:16:32+00:00","indicators_count":{"informative":26,"suspicious":3,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"184.30.208.161","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"address":"184.30.208.161","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"address":"93.184.221.240","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]}],"dns_resolutions":[{"domain":"www.skrill.com","address":"23.67.132.13","ttl":41,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Skrill Limited","registrar_name_servers":"A1-92.AKAM.NET","registrar_creation_date":"2003-04-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"domain":"www.neteller.com","address":"184.30.208.161","ttl":19,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Paysafe Group PLC","registrar_name_servers":"A1-92.AKAM.NET","registrar_creation_date":"2000-01-08T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"domain":"ocsp.pki.goog","address":"216.58.198.206","ttl":1980,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"domain":"fonts.gstatic.com","address":"216.58.198.195","ttl":299,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"domain":"fonts.googleapis.com","address":"216.58.208.202","ttl":3599,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"domain":"crl.pki.goog","address":"216.58.198.206","ttl":3325,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]}],"http_requests":[{"host":"www.neteller.com","host_ip":"184.30.208.161:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nAccept-Encoding: gzip, deflate\nHost: www.neteller.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}],"processes":[{"pid":2288,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\VerifyYourPayPalinRecordTi-CarlosArteagaJimenez.pdf\"","sha256":"e67a01f0d47be82ed631fe93f0b2f8c6276b4ce89b46b51d178e66f976b324bd","normalized_path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","uid":"00014020-00002288","icon":"$2d"},{"pid":2508,"ppid":2288,"name":"iexplore.exe","command_line":"-nohome \"http://www.neteller.com/\"","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00014020-00002288","uid":"00024710-00002508"},{"pid":3588,"ppid":2508,"name":"iexplore.exe","command_line":"SCODEF:2508 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00024710-00002508","uid":"00024760-00003588"}],"all_imported_dlls":["AGM.dll","nsi.dll","ieui.dll","duser.dll","devrtl.dll","ntdll.dll","msasn1.dll","oleaccrc.dll","propsys.dll","url.dll","ccme_ecc.dll","bcrypt.dll","winhttp.dll","jscript.dll","MSOXMLMF.DLL","URLREDIR.DLL","jp2ssv.dll","apphelp.dll","dui70.dll","IEShims.dll","cryptbase.dll","tzres.dll","ieproxy.dll","normaliz.dll","msimtf.dll","shlwapi.dll","dwmapi.dll","cfgmgr32.dll","dnsapi.dll","nlaapi.dll","ccme_base.dll","Wldap32.dll","NapiNSP.dll","ccme_asym.dll","credssp.dll","advapi32.dll","mswsock.dll","xmllite.dll","msfeeds.dll","CoolType.dll","uxtheme.dll","clbcatq.dll","msls31.dll","shell32.dll","profapi.dll","sqlite.dll","GdiPlus.dll","BIBUtils.dll","bcryptprimitives.dll","cryptsp.dll","RpcRtRemote.dll","oleaut32.dll","rasapi32.dll","gpapi.dll","kernel32.dll","IPHLPAPI.DLL","FWPUCLNT.DLL","dhcpcsvc.dll","imagehlp.dll","wsock32.dll","winnsi.dll","pnrpnsp.dll","ncrypt.dll","MSOHEV.DLL","rpcss.dll","crypt32.dll","ws2_32.dll","setupapi.dll","WSHTCPIP.DLL","winrnr.dll","schannel.dll","iecompat.dll","user32.dll","wship6.dll","ccme_base_non_fips.dll","userenv.dll","msvcp100.dll","ACE.dll","urlmon.dll","rtutils.dll","ieframe.dll","oleacc.dll","iepeers.dll","BIB.dll","mlang.dll","wininet.dll","imm32.dll","AcroRd32.dll","cabinet.dll","msvcr90.dll","KernelBase.dll","netprofm.dll","sxs.dll","cryptnet.dll","msvcrt.dll","ole32.dll","ntmarta.dll","AdobeXMP.dll","WSDApi.dll","msxml3.dll","imgutil.dll","version.dll","AXE8SharedExpat.dll","rasadhlp.dll","comdlg32.dll","ExplorerFrame.dll","wintrust.dll","ONBTTN~1.DLL","secur32.dll","usp10.dll","rpcrt4.dll","msctf.dll","comctl32.dll","msvcr100.dll","npmproxy.dll","mshtml.dll","sechost.dll","rasman.dll","AXSLE.dll","psapi.dll","webio.dll","cryptocme.dll","SensApi.dll","devobj.dll","ssv.dll","gdi32.dll","rsaenh.dll","dhcpcsvc6.dll","mscms.dll","sqmapi.dll","lpk.dll","msimg32.dll","msxml3r.dll","deploy.dll","t2embed.dll","ccme_ecdrbg.dll","iertutil.dll","sspicli.dll","pngfilt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"37174acf10a8a6b39cc7afb4ef77689001acf0b420c760d12739e667569e4fbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"pspubws@www.neteller[1].txt","sha256":"9414f4e178ef11ef2679054a739e8d123926f4a4dc8f432da49455c894003e26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"RecoveryStore.{2B383573-A662-11E8-BDA6-0A00279AEAA4}.dat","sha256":"fc45a824d189deb05dd87c09a3236da782e2d8622a810a9119f2d3ae82deb0ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"{2B383574-A662-11E8-BDA6-0A00279AEAA4}.dat","sha256":"069643c33832a5524cb275091cddef571f42ab9480965b6856ceb36c0f929569","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Mastercard-2018-Updated-Net_[1].png","sha256":"59ccd5a02d0c6cf5bb79c1751e47ddef41fee34b3ca93803d2558ebbab21db52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"fr[1].htm","sha256":"f78d9352e5d23a5f7d936e899486ee1b554865f3f7acc3f319dd352de2c9b298","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"fr[1].txt","sha256":"9e37b41af483856f9e9b43db67dff0d2cc9eb1584d6f81882dbdfd3f912b5164","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"gtm[1].js","sha256":"61f382fb626f90f67f8d998155f6277b38386f685112adc7bb2cf81733f02aef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"css[1].txt","sha256":"4cd4bd4af907718dd6b740f3a4710fa82bd3ea724274eefde8d3ddb54dab894f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"css[2].txt","sha256":"4cd4bd4af907718dd6b740f3a4710fa82bd3ea724274eefde8d3ddb54dab894f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"known_providers_download_v1[1].xml","sha256":"1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"merged-ddbedf6b8792bfd3f4a7fbdc865ebe6b-min[1].js","sha256":"9d4b4d3e7388179d0bd30b0b8908291b3f5375378f41e1dcd3b04988eac74cd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"sample-bg[1].jpg","sha256":"b32a3bbfb69dd315a9bcbf17f1cba8c92895c75f56f1ccc4415ee94372024880","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"favicon[1].ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"favicon[2].ico","sha256":"e5aa6a31c7aaa9f057ae02e48901f16254424f828ae4bd178fcec47cc0472649","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"home-money-transfer[1].jpg","sha256":"a84a6e73346646e240873f45539dd49e9b25a19deffbc5eb4f02d619c9d8e404","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"merged-2497ac6f5ef6a21f7bcb02667ded861e-min[1].css","sha256":"df22f3fdf2221483f2b2b39ae256c9195b4f6bfab0950a9942f61333f067fdec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"merged-f67211d576610f6e6f40db1565e7f56e-min[1].js","sha256":"5656596fe6418afbf3a0f5e0b232113d461b42a6bac73f9b5db61b340b52171b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"home-pay-online-usa[1].jpg","sha256":"0013551eccd9f5eb69a613e24e343f549881226e2d16e991f43464237fd819f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"mem8YaGs126MiZpBA-UFVZ0f[1].eot","sha256":"ee6885417a5772a42be3280cf34581001cafd5548d12b66b5466e53f05dabf96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]}],"files_written":[{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\RdLang32.DEU","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_rdlang32.deu","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"C:\\VerifyYourPayPalinRecordTi-CarlosArteagaJimenez.pdf","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Acroform.DEU","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_AcroForm.DEU","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\DigSig.DEU","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_DigSig.DEU","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\PPKLITE.DEU","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_PPKLite.DEU","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Annots.DEU","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_Annots.DEU","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annots.api","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdr.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdri.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdrk.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\Services.cfg","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\DEXEchoSign.spi","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\DEXShare.spi","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\files.acx","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\Files.asfx","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXEchoSign.asfx","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeComFnt11.lst","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeCMapFnt11.lst","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeSysFnt11.lst","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\AcroFnt11.lst","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\DigSig.api","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm.api","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\A9R1A14.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\A9R1A15.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\A9R1A16.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\A9R1A17.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\A9R1A18.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\A9R1A19.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Escript.deu","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_EScript.DEU","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\GlobData","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\GlobSettings","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\JSByteCodeWin.bin","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.sig","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_base.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"C:\\entropy","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_base_non_fips.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_asym.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc_non_fips.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecdrbg.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc_accel_fips.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc_accel_non_fips.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_error_info.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\Low","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{2B383573-A662-11E8-BDA6-0A00279AEAA4}.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\~DF0493823ECC0B15DA.TMP","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\url.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\frameiconcache.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBttnIE.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBTTN~1.DLL","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{2B383574-A662-11E8-BDA6-0A00279AEAA4}.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url:favicon","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\~DF53F0F452AF32149E.TMP","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds Cache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iecompat.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_25\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_25\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_1374AC543829516A5CA56081CD00C32A","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\CabCF77.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\TarCF78.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\fr[1].txt","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\fr[1].htm","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\merged-2497ac6f5ef6a21f7bcb02667ded861e-min[1].css","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\merged-f67211d576610f6e6f40db1565e7f56e-min[1].js","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\CabE77D.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\TarE77E.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\CabE77F.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\TarE780.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\CabEA02.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\TarEA0D.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\CabEA22.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\TarEA2D.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_7F4AA74A3B6AAF7E85F2F3FE1488680F","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_829B3C4B75BFD7E19130D8E48C9DE6A4","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_A729A47B1D4D2A7EF72CEB0BF6944560","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\01B16CDBADE7DB774141D7E30D50EC69","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\css[1].txt","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\css[2].txt","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_D87AB72AFD41327FE27102668732EE67","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_27FF1084E36FE08C28A63B3B9642E7AA","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@www.neteller[1].txt","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\merged-ddbedf6b8792bfd3f4a7fbdc865ebe6b-min[1].js","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\mshtml.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VPF8NG92\\home-pay-online-usa[1].jpg","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\Mastercard-2018-Updated-Net_[1].png","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\home-money-transfer[1].jpg","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\sample-bg[1].jpg","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_0FA67F94117BAB0C93EEAA75CB06B84C","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\F5F320A94D4D2B4465D8F17E2BB2D351_829B3C4B75BFD7E19130D8E48C9DE6A4","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\01B16CDBADE7DB774141D7E30D50EC69","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\F5F320A94D4D2B4465D8F17E2BB2D351_D87AB72AFD41327FE27102668732EE67","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VPF8NG92\\mem8YaGs126MiZpBA-UFVZ0f[1].eot","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_9B58E6A0DF94D833DF2DBB3558E30FEB","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\F5F320A94D4D2B4465D8F17E2BB2D351_9B58E6A0DF94D833DF2DBB3558E30FEB","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\gtm[1].js","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018082220180823","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\MSHist012018082220180823\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1616.net.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\163.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2345.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\355.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360.cn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4399.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\BPL0BFI3\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\51wan.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\56.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\61.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\95599.cn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\96pk.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abchina.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abcnews.go.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abril.com.br.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\accountonline.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\addictinggames.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\agame.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\allegro.pl.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alot.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.de.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ameblo.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\americanexpress.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\answers.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\aol.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ask.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\att.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\avast.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\badoo.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baidu.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baixaki.com.br.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bankofamerica.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baomihua.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bbc.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bing.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogger.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogspot.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\booking.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\caixa.gov.br.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cartoonnetwork.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ccb.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\china.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\chinanews.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\clubpenguin.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnet.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnn.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\comcast.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\comcast.net.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\commentcamarche.net.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cyworld.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dailymotion.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dangdang.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dell.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dianping.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\discoverbing.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\docin.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\douban.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\duowan.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ehow.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\exoplanetwar.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\facemoods.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fedex.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fileserve.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\filestube.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\flickr.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\foxsports.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\friv.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\funshion.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\geocities.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gmx.net.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\goo.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\google.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gougou.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\groupon.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\guardian.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gyyx.cn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hao123.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hatena.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hi5.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\homedepot.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotels.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotfile.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hp.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huanqiu.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huffingtonpost.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hulu.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iciba.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iegallery.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ifeng.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imdb.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imesh.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iminent.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\in.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\inbox.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\indeed.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\java.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\joy.cn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\juegos.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kaixin001.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kakaku.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kugou.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\leboncoin.fr.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\linkedin.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livedoor.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livejournal.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livingsocial.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\lowes.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\manta.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\match.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mediafire.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\megavideo.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mercadolivre.com.br.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\metrolyrics.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsoft.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsofttranslator.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\miniclip.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mlb.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\monster.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\moonbasa.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mop.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.org.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\msn.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mylife.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nate.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netflix.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netlog.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nhk.or.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nicovideo.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nk.pl.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\norton.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ocn.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\okwave.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\onet.pl.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orange.fr.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orkut.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\oyunlar1.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pagesjaunes.fr.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paipai.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pandora.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partycasino.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partypoker.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paypal.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pconline.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\photobucket.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\picnik.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pog.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pogo.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pps.tv.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pptv.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qidian.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qiyi.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rakuten.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rapidshare.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\reuters.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\samsung.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sdo.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\seesaa.net.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\shopathome.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\skycn.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\slideshare.net.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\softonic.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sohu.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soku.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soso.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soufun.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\southwest.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sponichi.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\surveymonkey.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\syyx.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\szgla.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\taleo.net.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\taobao.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\target.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\telegraph.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tenpay.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tianya.cn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\torrentz.eu.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tripadvisor.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tripod.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tudou.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\twitter.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\typepad.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\uol.com.br.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ups.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verizon.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verycd.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\vkontakte.ru.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\walmart.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\weather.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\web.de.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wellsfargo.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\whitepages.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikia.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikimapia.org.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikimedia.org.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikipedia.org.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\windows.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\windowslivehelp.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wn.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wowan365.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wp.pl.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\xdwan.cn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\y8.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yandex.ru.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yellowpages.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yelp.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youdao.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youku.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yzz.cn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zhenai.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zimbio.com.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zing.vn.url","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\~DF732376FE1C322D41.TMP","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\~DFE32DA9301E2FC189.TMP","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\~DFEC64B0C2D55BB1F7.TMP","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\~DF8DA5AB07006D5C7A.TMP","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\~DF0FD11B13B07D92E9.TMP","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\~DFE532BD02950233C8.TMP","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\KnoC91.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@microsoft[1].txt","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_49FC544F04082FD9F64F9EFB226AF8B5","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\50D6B15D9F2DCE1EDBB0C098625FBE47_10F47D053B284EB5F3ED5550578B001D","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8FE2C641C99CFA6687FA8D31B7D528A1","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D3BD78A30B98D17C317EDD4FFE850A0","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\CabFDB.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%TEMP%\\TarFDC.tmp","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ADO3AVS6\\known_providers_download_v1[1].xml","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bing[3].txt","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@www.bing[2].txt","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VPF8NG92\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VPF8NG92\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELL\\MUICACHE\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL,-12385\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL,-12385","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELL\\MUICACHE\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL,-12385\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL,-12385","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELLNOROAM\\MUICACHE\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL.MUI,-12385\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL.MUI,-12385","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELLNOROAM\\MUICACHE\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL.MUI,-12385\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL.MUI,-12385","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SUGGESTED SITES\\ENABLED\\ENABLED","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LINKSBAR\\ITEMCACHE\\0\\EXPIRATION\\EXPIRATION","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LINKSBAR\\ITEMCACHE\\1\\EXPIRATION\\EXPIRATION","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\\EXTENSIBLE CACHE\\MSHIST012017022820170301\\","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\\EXTENSIBLE CACHE\\MSHIST012017030120170302\\","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\\75E0ABB6138512271C04F85FDDDE38E4B7242EFE","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCOOJGAPIAAAAA","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCOOJGAPIAAAAA","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<2508>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RSS Eventing Connection Database Mutex 000009cc","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feed Eventing Shared Memory Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feed Arbitration Shared Memory Mutex [ User : S-1-5-21-4162757579-3804539371-4239455898-1000 ]","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feeds Store Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\Feeds Store Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\RSS Eventing Connection Database Mutex 000009cc","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\Feed Eventing Shared Memory Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\Feed Arbitration Shared Memory Mutex [ User : S-1-5-21-4162757579-3804539371-4239455898-1000 ]","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"ConnHashTable<2508>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!feeds cache!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!iecompatcache!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!mshist012018082220180823!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!iecompatcache!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!mshist012018082220180823!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!feeds cache!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!privacie!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!privacie!","sources":[{"report_type":"sandbox","report_id":"5b7d71397ca3e133077a4f53"}]}]}},"report_ids":{"sandbox_job_ids":["5b7d71397ca3e133077a4f53"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 9c02e9b35cdb… — Score 94/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9c02e9b35cdb…. Threat score 94/100. 0/28 AV engines flagged this file. 4 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9c02e9b35cdbc100d63350a1e85220e70a8b37ca7c7b5b37a34bb5c215b515ae"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 9c02e9b35cdb… — Score 94/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9c02e9b35cdb…. Threat score 94/100. 0/28 AV engines flagged this file. 4 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9c02e9b35cdbc100d63350a1e85220e70a8b37ca7c7b5b37a34bb5c215b515ae"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 9c02e9b35cdb… — Score 94/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9c02e9b35cdb…. Threat score 94/100. 0/28 AV engines flagged this file. 4 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]