24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T427,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample aa5140311669… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample aa5140311669…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aa51403116692fc1be9782027bd4158c08c5c2b36545cb3fb8096d1af3e95d2b","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","aa51403116692fc1be9782027bd4158c08c5c2b36545cb3fb8096d1af3e95d2b"],"about":{"@type":"SoftwareApplication","name":"https://zenodo.org/record/4255110","applicationCategory":["url"],"identifier":"aa51403116692fc1be9782027bd4158c08c5c2b36545cb3fb8096d1af3e95d2b","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":0,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T50e,"urlblockindex_1_.bin" has type "data" "zenodo_1_.svg" has type "SVG Scalable Vector Graphics image" "6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27" has type "data" "6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442" has type "data" "S6VNCALY.txt" has type "ASCII text" "eu_1_.png" has type "PNG image data 88 x 60 8-bit/color RGBA non-interlaced" "B42QU7F5.txt" has type "ASCII text" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "texture_1_.png" has type "PNG image data 64 x 64 8-bit colormap non-interlaced" "07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B" has type "data" "_E9AA41B0-2094-11EB-8E9C-080027F86845_.dat" has type "Composite Document File V2 Document Cannot read section info" "07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D" has type "data" "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format flavor 65536 length 20464 version 1.1" "piwik_1_.gif" has type "GIF image data version 89a 1 x 1" "PYGE03WV.txt" has type "ASCII text" "dat9E17.tmp" has type "OpenType font data" "locale_1_.properties" has type "ASCII text" "dat9EE6.tmp" has type "TrueType font data" "en-US.3" has type "data" "pdfjs.d6478300_1_.js" has type "ASCII text"26:Te6b,Pattern match: "https://zenodo.org/record/4255110" Pattern match: "https://zenodo.org" Heuristic match: "ocsp.sectigo.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEAx7F6ouVcdfk5QsSY4CTSE%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.sectigo.com" Heuristic match: "crt.usertrust.com" Heuristic match: "GET /USERTrustRSAAddTrustCA.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.usertrust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEHDSurvBDhHjOVfTCmFHLew%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.sectigo.com" Heuristic match: "cdnjs.cloudflare.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "m.addthis.com" Heuristic match: "piwik.web.cern.ch" Heuristic match: "s7.addthis.com" Heuristic match: "v1.addthisedge.com" Heuristic match: "z.moatads.com" Heuristic match: "zenodo-broker.web.cern.ch" Heuristic match: "zenodo.org" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://docs.angularjs.org/api/ng.$sce" Pattern match: "http://docs.angularjs.org/api/ng.$sce,t" Pattern match: "errors.angularjs.org/1.4.14/+(t?t+/:)+s,i=r,n=?;i" Pattern match: "http://docs.angularjs.org/api/angular.element" Pattern match: "http://:mailto" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0" Pattern match: "http://msdn.microsoft.com/en-us/library/ie/hh772302(v=vs.85).aspx" Pattern match: "https://bugzilla.mozilla.org/show_bug.cgi?id=972126" Pattern match: "http://www.wolframalpha.com/input/" Pattern match: "https://bugzilla.mozilla.org/show_bug.cgi?id=726227" Pattern match: "https://bugzilla.mozilla.org/show_bug.cgi?id=664884" Pattern match: "https://bugzilla.mozilla.org/show_bug.cgi?id=810490" Pattern match: "https://github.com/Polymer/URL" Pattern match: "console.log/warn" Pattern match: "http://www.w3.org/International/questions/qa-scripts" Pattern match: "http://www.w3.org/TR/DOM-Level-3-Events/#events-MouseEvent-buttons" Pattern match: "https://crbug.com/355116" Pattern match: "http://mozilla.github.io" Pattern match: "https://bugzilla.mozilla.org/show_bug.cgi?id=1183881" Pattern match: "https://bugzilla.mozilla.org/show_bug.cgi?id=683280" Pattern match: "https://github.com/notmasteryet/jpgjs" Pattern match: "http://tools.ietf.org/html/rfc3986#section-3.1" Pattern match: "https://developer.apple.com/fonts/TTRefMan/RM05/Chap5.html" Pattern match: "https://github.com/mozilla/pdf.js/pull/2127#discussion_r1662280" Pattern match: "http://code.google.com/p/chromium/issues/detail?id=122465" Pattern match: "Math.min/Math.max" Pattern match: "http://www.poynton.com/notes/colour_and_gamma/ColorFAQ.html" Pattern match: "http://www.color.org/srgb.pdf" Pattern match: "https://github.com/mozilla/pdf.js/pull/6266" Pattern match: "https://github.com/mozilla/pdf.js/issues/6179" Pattern match: "https://bugzilla.mozilla.org/show_bug.cgi?id=707484" Pattern match: "http://piwik.org" Pattern match: "http://developer.piwik.org/guides/tracking-javascript-guide#multiple-piwik-trackers" Pattern match: "http://+cA}cB.href=p.toAbsoluteUrl(cA);if(cB.pathname){return" Pattern match: "https://zenodo-broker.web.cern.ch/api/relationships?page=1&id=10.5281%2Fzenodo.4255109&scheme=doi&group_by=version&relation=isCitedBy&sort=-mostrecent&size=10"27:T840,"iexplore.exe" wrote bytes "60d2c36e" to virtual address "0x76BD1D7C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033c06e" to virtual address "0x75BA11BC" (part of module "GDI32.DLL") "iexplore.exe" wrote bytes "b033c06e" to virtual address "0x75B411B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "60d2c36e" to virtual address "0x75B413B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "b033c06e" to virtual address "0x75ED14E0" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "c03ac06e" to virtual address "0x76BD1FB0" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033c06e" to virtual address "0x74411250" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "b033c06e" to virtual address "0x76411210" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "a035c06e" to virtual address "0x76BD202C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "a035c06e" to virtual address "0x77971144" (part of module "LPK.DLL") "iexplore.exe" wrote bytes "c0bfc16e" to virtual address "0x76BD1F68" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "a035c06e" to virtual address "0x761AB0CC" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "b033c06e" to virtual address "0x75D417CC" (part of module "ADVAPI32.DLL") "iexplore.exe" wrote bytes "b033c06e" to virtual address "0x6DBAF6A0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "a035c06e" to virtual address "0x7441139C" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "8032e4007032e4000032e4006032e4005032e4004032e4003032e400000000002cc9cd76c021e400000000009017e4005023e4000018e400601fe4002036e400000000004036e40000000000" to virtual address "0x00E48000" "iexplore.exe" wrote bytes "b033c06e" to virtual address "0x00E470C0" "iexplore.exe" wrote bytes "70ccc36e" to virtual address "0x75B41310" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "a035c06e" to virtual address "0x76411064" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "b033c06e" to virtual address "0x761A917C" (part of module "IERTUTIL.DLL")28:T7fe4,"\x00\x01' + // encodingID string32(4 + numTables * 8); // start of the table record var i, ii, j, jj; for (i = ranges.length - 1; i >= 0; --i) { if (ranges[i][0] <= 0xFFFF) { break; } } var bmpLength = i + 1; if (ranges[i][0] < 0xFFFF && ranges[i][1] === 0xFFFF) { ranges[i][1] = 0xFFFE; } var trailingRangesCount = ranges[i][1] < 0xFFFF ? 1 : 0; var segCount = bmpLength + trailingRangesCount; var searchParams = OpenTypeFileBuilder.getSearchParams(segCount, 2); // Fill up the 4 parallel arrays describing the segments. var startCount = ''; var endCount = ''; var idDeltas = ''; var idRangeOffsets = ''; var glyphsIds = ''; var bias = 0; var range, start, end, codes; for (i = 0, ii = bmpLength; i < ii; i++) { range = ranges[i]; start = range[0]; end = range[1]; startCount += string16(start); endCount += string16(end); codes = range[2]; var contiguous = true; for (j = 1, jj = codes.length; j < jj; ++j) { if (codes[j] !== codes[j - 1] + 1) { contiguous = false; break; } } if (!contiguous) { var offset = (segCount - i) * 2 + bias * 2; bias += (end - start + 1); idDeltas += string16(0); idRangeOffsets += string16(offset); for (j = 0, jj = codes.length; j < jj; ++j) { glyphsIds += string16(codes[j]); } } else { var startCode = codes[0]; idDeltas += string16((startCode - start) & 0xFFFF); idRangeOffsets += string16(0); } } if (trailingRangesCount > 0) { endCount += '\xFF\xFF'; startCount += '\xFF\xFF'; idDeltas += '\x00\x01'; idRangeOffsets += '\x00\x00'; } var format314 = '\x00\x00' + // language string16(2 * segCount) + string16(searchParams.range) + string16(searchParams.entry) + string16(searchParams.rangeShift) + endCount + '\x00\x00' + startCount + idDeltas + idRangeOffsets + glyphsIds; var format31012 = ''; var header31012 = ''; if (numTables > 1) { cmap += '\x00\x03' + // platformID '\x00\x0A' + // encodingID string32(4 + numTables * 8 + 4 + format314.length); // start of the table record format31012 = ''; for (i = 0, ii = ranges.length; i < ii; i++) { range = ranges[i]; start = range[0]; codes = range[2]; var code = codes[0]; for (j = 1, jj = codes.length; j < jj; ++j) { if (codes[j] !== codes[j - 1] + 1) { end = range[0] + j - 1; format31012 += string32(start) + // startCharCode string32(end) + // endCharCode string32(code); // startGlyphID start = end + 1; code = codes[j]; } } format31012 += string32(start) + // startCharCode string32(range[1]) + // endCharCode string32(code); // startGlyphID } header31012 = '\x00\x0C' + // format '\x00\x00' + // reserved string32(format31012.length + 16) + // length '\x00\x00\x00\x00' + // language string32(format31012.length / 12); // nGroups } return cmap + '\x00\x04' + // format string16(format314.length + 4) + // length format314 + header31012 + format31012; } function validateOS2Table(os2) { var stream = new Stream(os2.data); var version = stream.getUint16(); // TODO verify all OS/2 tables fields, but currently we validate only those // that give us issues stream.getBytes(60); // skipping type, misc sizes, panose, unicode ranges var selection = stream.getUint16(); if (version < 4 && (selection & 0x0300)) { return false; } var firstChar = stream.getUint16(); var lastChar = stream.getUint16(); if (firstChar > lastChar) { return false; } stream.getBytes(6); // skipping sTypoAscender/Descender/LineGap var usWinAscent = stream.getUint16(); if (usWinAscent === 0) { // makes font unreadable by windows return false; } // OS/2 appears to be valid, resetting some fields os2.data[8] = os2.data[9] = 0; // IE rejects fonts if fsType != 0 return true; } function createOS2Table(properties, charstrings, override) { override = override || { unitsPerEm: 0, yMax: 0, yMin: 0, ascent: 0, descent: 0 }; var ulUnicodeRange1 = 0; var ulUnicodeRange2 = 0; var ulUnicodeRange3 = 0; var ulUnicodeRange4 = 0; var firstCharIndex = null; var lastCharIndex = 0; if (charstrings) { for (var code in charstrings) { code |= 0; if (firstCharIndex > code || !firstCharIndex) { firstCharIndex = code; } if (lastCharIndex < code) { lastCharIndex = code; } var position = getUnicodeRangeFor(code); if (position < 32) { ulUnicodeRange1 |= 1 << position; } else if (position < 64) { ulUnicodeRange2 |= 1 << position - 32; } else if (position < 96) { ulUnicodeRange3 |= 1 << position - 64; } else if (position < 123) { ulUnicodeRange4 |= 1 << position - 96; } else { error('Unicode ranges Bits > 123 are reserved for internal usage'); } } } else { // TODO firstCharIndex = 0; lastCharIndex = 255; } var bbox = properties.bbox || [0, 0, 0, 0]; var unitsPerEm = (override.unitsPerEm || 1 / (properties.fontMatrix || FONT_IDENTITY_MATRIX)[0]); // if the font units differ to the PDF glyph space units // then scale up the values var scale = (properties.ascentScaled ? 1.0 : unitsPerEm / PDF_GLYPH_SPACE_UNITS); var typoAscent = (override.ascent || Math.round(scale * (properties.ascent || bbox[3]))); var typoDescent = (override.descent || Math.round(scale * (properties.descent || bbox[1]))); if (typoDescent > 0 && properties.descent > 0 && bbox[1] < 0) { typoDescent = -typoDescent; // fixing incorrect descent } var winAscent = override.yMax || typoAscent; var winDescent = -override.yMin || -typoDescent; return '\x00\x03' + // version '\x02\x24' + // xAvgCharWidth '\x01\xF4' + // usWeightClass '\x00\x05' + // usWidthClass '\x00\x00' + // fstype (0 to let the font loads via font-face on IE) '\x02\x8A' + // ySubscriptXSize '\x02\xBB' + // ySubscriptYSize '\x00\x00' + // ySubscriptXOffset '\x00\x8C' + // ySubscriptYOffset '\x02\x8A' + // ySuperScriptXSize '\x02\xBB' + // ySuperScriptYSize '\x00\x00' + // ySuperScriptXOffset '\x01\xDF' + // ySuperScriptYOffset '\x00\x31' + // yStrikeOutSize '\x01\x02' + // yStrikeOutPosition '\x00\x00' + // sFamilyClass '\x00\x00\x06' + String.fromCharCode(properties.fixedPitch ? 0x09 : 0x00) + '\x00\x00\x00\x00\x00\x00' + // Panose string32(ulUnicodeRange1) + // ulUnicodeRange1 (Bits 0-31) string32(ulUnicodeRange2) + // ulUnicodeRange2 (Bits 32-63) string32(ulUnicodeRange3) + // ulUnicodeRange3 (Bits 64-95) string32(ulUnicodeRange4) + // ulUnicodeRange4 (Bits 96-127) '\x2A\x32\x31\x2A' + // achVendID string16(properties.italicAngle ? 1 : 0) + // fsSelection string16(firstCharIndex || properties.firstChar) + // usFirstCharIndex string16(lastCharIndex || properties.lastChar) + // usLastCharIndex string16(typoAscent) + // sTypoAscender string16(typoDescent) + // sTypoDescender '\x00\x64' + // sTypoLineGap (7%-10% of the unitsPerEM value) string16(winAscent) + // usWinAscent string16(winDescent) + // usWinDescent '\x00\x00\x00\x00' + // ulCodePageRange1 (Bits 0-31) '\x00\x00\x00\x00' + // ulCodePageRange2 (Bits 32-63) string16(properties.xHeight) + // sxHeight string16(properties.capHeight) + // sCapHeight string16(0) + // usDefaultChar string16(firstCharIndex || properties.firstChar) + // usBreakChar '\x00\x03'; // usMaxContext } function createPostTable(properties) { var angle = Math.floor(properties.italicAngle * (Math.pow(2, 16))); return ('\x00\x03\x00\x00' + // Version number string32(angle) + // italicAngle '\x00\x00' + // underlinePosition '\x00\x00' + // underlineThickness string32(properties.fixedPitch) + // isFixedPitch '\x00\x00\x00\x00' + // minMemType42 '\x00\x00\x00\x00' + // maxMemType42 '\x00\x00\x00\x00' + // minMemType1 '\x00\x00\x00\x00'); // maxMemType1 } function createNameTable(name, proto) { if (!proto) { proto = [[], []]; // no strings and unicode strings } var strings = [ proto[0][0] || 'Original licence', // 0.Copyright proto[0][1] || name, // 1.Font family proto[0][2] || 'Unknown', // 2.Font subfamily (font weight) proto[0][3] || 'uniqueID', // 3.Unique ID proto[0][4] || name, // 4.Full font name proto[0][5] || 'Version 0.11', // 5.Version proto[0][6] || '', // 6.Postscript name proto[0][7] || 'Unknown', // 7.Trademark proto[0][8] || 'Unknown', // 8.Manufacturer proto[0][9] || 'Unknown' // 9.Designer ]; // Mac want 1-byte per character strings while Windows want // 2-bytes per character, so duplicate the names table var stringsUnicode = []; var i, ii, j, jj, str; for (i = 0, ii = strings.length; i < ii; i++) { str = proto[1][i] || strings[i]; var strBufUnicode = []; for (j = 0, jj = str.length; j < jj; j++) { strBufUnicode.push(string16(str.charCodeAt(j))); } stringsUnicode.push(strBufUnicode.join('')); } var names = [strings, stringsUnicode]; var platforms = ['\x00\x01', '\x00\x03']; var encodings = ['\x00\x00', '\x00\x01']; var languages = ['\x00\x00', '\x04\x09']; var namesRecordCount = strings.length * platforms.length; var nameTable = '\x00\x00' + // format string16(namesRecordCount) + // Number of names Record string16(namesRecordCount * 12 + 6); // Storage // Build the name records field var strOffset = 0; for (i = 0, ii = platforms.length; i < ii; i++) { var strs = names[i]; for (j = 0, jj = strs.length; j < jj; j++) { str = strs[j]; var nameRecord = platforms[i] + // platform ID encodings[i] + // encoding ID languages[i] + // language ID string16(j) + // name ID string16(str.length) + string16(strOffset); nameTable += nameRecord; strOffset += str.length; } } nameTable += strings.join('') + stringsUnicode.join(''); return nameTable; } Font.prototype = { name: null, font: null, mimetype: null, encoding: null, get renderer() { var renderer = FontRendererFactory.create(this, SEAC_ANALYSIS_ENABLED); return shadow(this, 'renderer', renderer); }, exportData: function Font_exportData() { // TODO remove enumerating of the properties, e.g. hardcode exact names. var data = {}; for (var i in this) { if (this.hasOwnProperty(i)) { data[i] = this[i]; } } return data; }, checkAndRepair: function Font_checkAndRepair(name, font, properties) { function readTableEntry(file) { var tag = bytesToString(file.getBytes(4)); var checksum = file.getInt32() >>> 0; var offset = file.getInt32() >>> 0; var length = file.getInt32() >>> 0; // Read the table associated data var previousPosition = file.pos; file.pos = file.start ? file.start : 0; file.skip(offset); var data = file.getBytes(length); file.pos = previousPosition; if (tag === 'head') { // clearing checksum adjustment data[8] = data[9] = data[10] = data[11] = 0; data[17] |= 0x20; //Set font optimized for cleartype flag } return { tag: tag, checksum: checksum, length: length, offset: offset, data: data }; } function readOpenTypeHeader(ttf) { return { version: bytesToString(ttf.getBytes(4)), numTables: ttf.getUint16(), searchRange: ttf.getUint16(), entrySelector: ttf.getUint16(), rangeShift: ttf.getUint16() }; } /** * Read the appropriate subtable from the cmap according to 9.6.6.4 from * PDF spec */ function readCmapTable(cmap, font, isSymbolicFont, hasEncoding) { if (!cmap) { warn('No cmap table available.'); return { platformId: -1, encodingId: -1, mappings: [], hasShortCmap: false }; } var segment; var start = (font.start ? font.start : 0) + cmap.offset; font.pos = start; var version = font.getUint16(); var numTables = font.getUint16(); var potentialTable; var canBreak = false; // There's an order of preference in terms of which cmap subtable to // use: // - non-symbolic fonts the preference is a 3,1 table then a 1,0 table // - symbolic fonts the preference is a 3,0 table then a 1,0 table // The following takes advantage of the fact that the tables are sorted // to work. for (var i = 0; i < numTables; i++) { var platformId = font.getUint16(); var encodingId = font.getUint16(); var offset = font.getInt32() >>> 0; var useTable = false; if (platformId === 0 && encodingId === 0) { useTable = true; // Continue the loop since there still may be a higher priority // table. } else if (platformId === 1 && encodingId === 0) { useTable = true; // Continue the loop since there still may be a higher priority // table. } else if (platformId === 3 && encodingId === 1 && ((!isSymbolicFont && hasEncoding) || !potentialTable)) { useTable = true; if (!isSymbolicFont) { canBreak = true; } } else if (isSymbolicFont && platformId === 3 && encodingId === 0) { useTable = true; canBreak = true; } if (useTable) { potentialTable = { platformId: platformId, encodingId: encodingId, offset: offset }; } if (canBreak) { break; } } if (potentialTable) { font.pos = start + potentialTable.offset; } if (!potentialTable || font.peekByte() === -1) { warn('Could not find a preferred cmap table.'); return { platformId: -1, encodingId: -1, mappings: [], hasShortCmap: false }; } var format = font.getUint16(); var length = font.getUint16(); var language = font.getUint16(); var hasShortCmap = false; var mappings = []; var j, glyphId; // TODO(mack): refactor this cmap subtable reading logic out if (format === 0) { for (j = 0; j < 256; j++) { var index = font.getByte(); if (!index) { continue; }" "toUnicode.length === 0x10000); // Helper function to try to skip mapping of empty glyphs. // Note: In some cases, just relying on the glyph data doesn't work, // hence we also use a few heuristics to fix various PDF files. function hasGlyph(glyphId, charCode, widthCode) { if (!missingGlyphs[glyphId]) { return true; } if (!skipToUnicode && charCode >= 0 && toUnicode.has(charCode)) { return true; } if (widths && widthCode >= 0 && isNum(widths[widthCode])) { return true; } return false; } // Some bad PDF generators, e.g. Scribus PDF, include glyph names // in a 'uniXXXX' format -- attempting to recover proper ones. function recoverGlyphName(name, glyphsUnicodeMap) { if (glyphsUnicodeMap[name] !== undefined) { return name; } // The glyph name is non-standard, trying to recover. var unicode = getUnicodeForGlyph(name, glyphsUnicodeMap); if (unicode !== -1) { for (var key in glyphsUnicodeMap) { if (glyphsUnicodeMap[key] === unicode) { return key; } } } warn('Unable to recover a standard glyph name for: ' + name); return name; } if (properties.type === 'CIDFontType2') { var cidToGidMap = properties.cidToGidMap || []; var isCidToGidMapEmpty = cidToGidMap.length === 0; properties.cMap.forEach(function(charCode, cid) { assert(cid <= 0xffff, 'Max size of CID is 65,535'); var glyphId = -1; if (isCidToGidMapEmpty) { glyphId = cid; } else if (cidToGidMap[cid] !== undefined) { glyphId = cidToGidMap[cid]; } if (glyphId >= 0 && glyphId < numGlyphs && hasGlyph(glyphId, charCode, cid)) { charCodeToGlyphId[charCode] = glyphId; } }); if (dupFirstEntry) { charCodeToGlyphId[0] = numGlyphs - 1; } } else { // Most of the following logic in this code branch is based on the // 9.6.6.4 of the PDF spec. var hasEncoding = properties.differences.length > 0 || !!properties.baseEncodingName; var cmapTable = readCmapTable(tables['cmap'], font, this.isSymbolicFont, hasEncoding); var cmapPlatformId = cmapTable.platformId; var cmapEncodingId = cmapTable.encodingId; var cmapMappings = cmapTable.mappings; var cmapMappingsLength = cmapMappings.length; // The spec seems to imply that if the font is symbolic the encoding // should be ignored, this doesn't appear to work for 'preistabelle.pdf' // where the the font is symbolic and it has an encoding. if (hasEncoding && (cmapPlatformId === 3 && cmapEncodingId === 1 || cmapPlatformId === 1 && cmapEncodingId === 0) || (cmapPlatformId === -1 && cmapEncodingId === -1 && // Temporary hack !!getEncoding(properties.baseEncodingName))) { // Temporary hack // When no preferred cmap table was found and |baseEncodingName| is // one of the predefined encodings, we seem to obtain a better // |charCodeToGlyphId| map from the code below (fixes bug 1057544). // TODO: Note that this is a hack which should be removed as soon as // we have proper support for more exotic cmap tables. var baseEncoding = []; if (properties.baseEncodingName === 'MacRomanEncoding' || properties.baseEncodingName === 'WinAnsiEncoding') { baseEncoding = getEncoding(properties.baseEncodingName); } var glyphsUnicodeMap = getGlyphsUnicode(); for (charCode = 0; charCode < 256; charCode++) { var glyphName, standardGlyphName; if (this.differences && charCode in this.differences) { glyphName = this.differences[charCode]; } else if (charCode in baseEncoding && baseEncoding[charCode] !== '') { glyphName = baseEncoding[charCode]; } else { glyphName = StandardEncoding[charCode]; } if (!glyphName) { continue; } // Ensure that non-standard glyph names are resolved to valid ones. standardGlyphName = recoverGlyphName(glyphName, glyphsUnicodeMap); var unicodeOrCharCode, isUnicode = false; if (cmapPlatformId === 3 && cmapEncodingId === 1) { unicodeOrCharCode = glyphsUnicodeMap[standardGlyphName]; isUnicode = true; } else if (cmapPlatformId === 1 && cmapEncodingId === 0) { // TODO: the encoding needs to be updated with mac os table. unicodeOrCharCode = MacRomanEncoding.indexOf(standardGlyphName); } var found = false; for (i = 0; i < cmapMappingsLength; ++i) { if (cmapMappings[i].charCode !== unicodeOrCharCode) { continue; } var code = isUnicode ? charCode : unicodeOrCharCode; if (hasGlyph(cmapMappings[i].glyphId, code, -1)) { charCodeToGlyphId[charCode] = cmapMappings[i].glyphId; found = true; break; } } if (!found && properties.glyphNames) { // Try to map using the post table. var glyphId = properties.glyphNames.indexOf(glyphName); // The post table ought to use the same kind of glyph names as the // `differences` array, but check the standard ones as a fallback. if (glyphId === -1 && standardGlyphName !== glyphName) { glyphId = properties.glyphNames.indexOf(standardGlyphName); } if (glyphId > 0 && hasGlyph(glyphId, -1, -1)) { charCodeToGlyphId[charCode] = glyphId; found = true; } } if (!found) { charCodeToGlyphId[charCode] = 0; // notdef } } } else if (cmapPlatformId === 0 && cmapEncodingId === 0) { // Default Unicode semantics, use the charcodes as is. for (i = 0; i < cmapMappingsLength; ++i) { charCodeToGlyphId[cmapMappings[i].charCode] = cmapMappings[i].glyphId; } } else { // For (3, 0) cmap tables: // The charcode key being stored in charCodeToGlyphId is the lower // byte of the two-byte charcodes of the cmap table since according to // the spec: 'each byte from the string shall be prepended with the // high byte of the range [of charcodes in the cmap table], to form // a two-byte character, which shall be used to select the // associated glyph description from the subtable'. // // For (1, 0) cmap tables: // 'single bytes from the string shall be used to look up the // associated glyph descriptions from the subtable'. This means // charcodes in the cmap will be single bytes, so no-op since // glyph.charCode & 0xFF === glyph.charCode for (i = 0; i < cmapMappingsLength; ++i) { charCode = cmapMappings[i].charCode & 0xFF; charCodeToGlyphId[charCode] = cmapMappings[i].glyphId; } } } if (charCodeToGlyphId.length === 0) { // defines at least one glyph charCodeToGlyphId[0] = 0; } // Converting glyphs and ids into font's cmap table var newMapping = adjustMapping(charCodeToGlyphId, properties); this.toFontChar = newMapping.toFontChar; tables['cmap'] = { tag: 'cmap', data: createCmapTable(newMapping.charCodeToGlyphId, numGlyphs) }; if (!tables['OS/2'] || !validateOS2Table(tables['OS/2'])) { tables['OS/2'] = { tag: 'OS/2', data: createOS2Table(properties, newMapping.charCodeToGlyphId, metricsOverride) }; } // Rewrite the 'post' table if needed if (!tables['post']) { tables['post'] = { tag: 'post', data: createPostTable(properties) }; } if (!isTrueType) { try { // Trying to repair CFF file cffFile = new Stream(tables['CFF '].data); var parser = new CFFParser(cffFile, properties, SEAC_ANALYSIS_ENABLED); cff = parser.parse(); var compiler = new CFFCompiler(cff); tables['CFF '].data = compiler.compile(); } catch (e) { warn('Failed to compile font ' + properties.loadedName); } } // Re-creating 'name' table if (!tables['name']) { tables['name'] = { tag: 'name', data: createNameTable(this.name) }; } else { // ... using existing 'name' table as prototype var namePrototype = readNameTable(tables['name']); tables['name'].data = createNameTable(name, namePrototype); } var builder = new OpenTypeFileBuilder(header.version); for (var tableTag in tables) { builder.addTable(tableTag, tables[tableTag].data); } return builder.toArray(); }, convert: function Font_convert(fontName, font, properties) { // TODO: Check the charstring widths to determine this. properties.fixedPitch = false; var mapping = font.getGlyphMapping(properties); var newMapping = adjustMapping(mapping, properties); this.toFontChar = newMapping.toFontChar; var numGlyphs = font.numGlyphs; function getCharCodes(charCodeToGlyphId, glyphId) { var charCodes = null; for (var charCode in charCodeToGlyphId) { if (glyphId === charCodeToGlyphId[charCode]) { if (!charCodes) { charCodes = []; } charCodes.push(charCode | 0); } } return charCodes; } function createCharCode(charCodeToGlyphId, glyphId) { for (var charCode in charCodeToGlyphId) { if (glyphId === charCodeToGlyphId[charCode]) { return charCode | 0; } } newMapping.charCodeToGlyphId[newMapping.nextAvailableFontCharCode] = glyphId; return newMapping.nextAvailableFontCharCode++; } var seacs = font.seacs; if (SEAC_ANALYSIS_ENABLED && seacs && seacs.length) { var matrix = properties.fontMatrix || FONT_IDENTITY_MATRIX; var charset = font.getCharset(); var seacMap = Object.create(null); for (var glyphId in seacs) { glyphId |= 0; var seac = seacs[glyphId]; var baseGlyphName = StandardEncoding[seac[2]]; var accentGlyphName = StandardEncoding[seac[3]]; var baseGlyphId = charset.indexOf(baseGlyphName); var accentGlyphId = charset.indexOf(accentGlyphName); if (baseGlyphId < 0 || accentGlyphId < 0) { continue; } var accentOffset = { x: seac[0] * matrix[0] + seac[1] * matrix[2] + matrix[4], y: seac[0] * matrix[1] + seac[1] * matrix[3] + matrix[5] }; var charCodes = getCharCodes(mapping, glyphId); if (!charCodes) { // There's no point in mapping it if the char code was never mapped // to begin with. continue; } for (var i = 0, ii = charCodes.length; i < ii; i++) { var charCode = charCodes[i]; // Find a fontCharCode that maps to the base and accent glyphs. // If one doesn't exists, create it. var charCodeToGlyphId = newMapping.charCodeToGlyphId; var baseFontCharCode = createCharCode(charCodeToGlyphId, baseGlyphId); var accentFontCharCode = createCharCode(charCodeToGlyphId, accentGlyphId); seacMap[charCode] = { baseFontCharCode: baseFontCharCode, accentFontCharCode: accentFontCharCode, accentOffset: accentOffset }; } } properties.seacMap = seacMap; } var unitsPerEm = 1 / (properties.fontMatrix || FONT_IDENTITY_MATRIX)[0]; var builder = new OpenTypeFileBuilder('\x4F\x54\x54\x4F'); // PostScript Font Program builder.addTable('CFF ', font.data); // OS/2 and Windows Specific metrics builder.addTable('OS/2', createOS2Table(properties, newMapping.charCodeToGlyphId)); // Character to glyphs mapping builder.addTable('cmap', createCmapTable(newMapping.charCodeToGlyphId, numGlyphs)); // Font header builder.addTable('head', '\x00\x01\x00\x00' + // Version number '\x00\x00\x10\x00' + // fontRevision '\x00\x00\x00\x00' + // checksumAdjustement '\x5F\x0F\x3C\xF5' + // magicNumber '\x00\x00' + // Flags safeString16(unitsPerEm) + // unitsPerEM '\x00\x00\x00\x00\x9e\x0b\x7e\x27' + // creation date '\x00\x00\x00\x00\x9e\x0b\x7e\x27' + // modifification date '\x00\x00' + // xMin safeString16(properties.descent) + // yMin '\x0F\xFF' + // xMax safeString16(properties.ascent) + // yMax string16(properties.italicAngle ? 2 : 0) + // macStyle '\x00\x11' + // lowestRecPPEM '\x00\x00' + // fontDirectionHint '\x00\x00' + // indexToLocFormat '\x00\x00'); // glyphDataFormat // Horizontal header builder.addTable('hhea', '\x00\x01\x00\x00' + // Version number safeString16(properties.ascent) + // Typographic Ascent safeString16(properties.descent) + // Typographic Descent '\x00\x00' + // Line Gap '\xFF\xFF' + // advanceWidthMax '\x00\x00' + // minLeftSidebearing '\x00\x00' + // minRightSidebearing '\x00\x00' + // xMaxExtent safeString16(properties.capHeight) + // caretSlopeRise safeString16(Math.tan(properties.italicAngle) * properties.xHeight) + // caretSlopeRun '\x00\x00' + // caretOffset '\x00\x00' + // -reserved- '\x00\x00' + // -reserved- '\x00\x00' + // -reserved- '\x00\x00' + // -reserved- '\x00\x00' + // metricDataFormat string16(numGlyphs)); // Number of HMetrics // Horizontal metrics builder.addTable('hmtx', (function fontFieldsHmtx() { var charstrings = font.charstrings; var cffWidths = font.cff ? font.cff.widths : null; var hmtx = '\x00\x00\x00\x00'; // Fake .notdef for (var i = 1, ii = numGlyphs; i < ii; i++) { var width = 0; if (charstrings) { var charstring = charstrings[i - 1]; width = 'width' in charstring ? charstring.width : 0; } else if (cffWidths) { width = Math.ceil(cffWidths[i] || 0); } hmtx += string16(width) + string16(0); } return hmtx; })()); // Maximum profile builder.addTable('maxp', '\x00\x00\x50\x00' + // Version number string16(numGlyphs)); // Num of glyphs // Naming tables builder.addTable('name', createNameTable(fontName)); // PostScript informations builder.addTable('post', createPostTable(properties)); return builder.toArray(); }, get spaceWidth() { if ('_shadowWidth' in this) { return this._shadowWidth; } // trying to estimate space character width var possibleSpaceReplacements = ['space', 'minus', 'one', 'i']; var width; for (var i = 0, ii = possibleSpaceReplacements.length; i < ii; i++) { var glyphName = possibleSpaceR"29:T581,Found malicious artifacts related to "23.54.162.144": ... URL: http://a59.g.akamai.net/f/59/9312/1m/ernstyoung.download.akamai.com/9312/fy2013/video6847/update/Set_Personal_Settings_and_Delegate_a_plan_with_new_branding20131216.htm (AV positives: 4/79 scanned on 06/30/2020 23:10:14) URL: http://setup-cxs.rbxcdn.com/version-ae7e1db3e82b4f7a-robloxstudiolauncherbeta.exe (AV positives: 1/79 scanned on 06/15/2020 15:33:18) URL: http://install-cdn.plurpush.net/ (AV positives: 2/79 scanned on 06/15/2020 13:55:02) URL: http://install-cdn.searchvortex.info/bed?r=2015040301&bet=3 (AV positives: 5/80 scanned on 06/14/2020 00:30:35) URL: http://install-cdn.searchvortex.info/bed?r=2015030911&bet=3 (AV positives: 5/80 scanned on 06/13/2020 16:34:19) File SHA256: 620398b087c7f5b2fd353579d94086b8f7e564267fab66acea27c101c3c903ff (AV positives: 19/76 scanned on 06/30/2020 23:09:47) File SHA256: 059163208affb8d4fc7504e32f1cba480a50192c9927d91e3e828cb88ffbceed (AV positives: 53/73 scanned on 01/02/2020 19:44:28) File SHA256: 3d958b9e297ebb035e6091a9fb193bf0ffb081fe0dfb85e83e7ead3b5fdfda8d (AV positives: 3/65 scanned on 02/23/2019 10:37:27) File SHA256: 3c825efb542031434ec4c1f5c58b49008e635c95778af3e75810a95f83d1324d (AV positives: 1/66 scanned on 02/21/2019 06:26:29) File SHA256: 08df44e0ad329deb84d895e62db791c46ab6dad2bca52ad7a39ab10103d45a46 (AV positives: 1/65 scanned on 02/21/2019 06:21:31)2a:T564,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD0klEQVR42u2XS2hTWRjHg7Nw4TADYqcdxFbFMqtZjjOzUgdFRWtbEjuPMgu3wygoCqXooKIoVGiNaZuWLtsunIdTmG4GN4VQZmBaLPRlKK0P0iZ9JJmYx03u4+/3nZs0zTX39jZx2Q/+5EHO+f++75zznRuHYzu2wxBTU1NYWlrC8vIygsGgTem/DwQCGB0dRX19PUoGmJ6ehqZpKCVkWQaPZwin04mSAdLptJiQQTRNhaqaSYGi5MUxNzcHv9+PyclJNDY2okwAc2OjeQ7gxYsFLC4uis8TExNobm5GyQB2ss5LFmM4+/n5efE+EonA5/PB5XJhSwCSJJkCmJnnAGZmZjA42E8axMDAAIaGhjA8PPy+AMzNeQOychEKhQTM2NiYgCgTQDE1zxnnlUEmkyk4SbOzs+UAbJ71RvMcgC6eR0MikSgVoBzztBADRKPRrQKkRAk3L7nRNG/MJ4nF80Sjka0BpFJGALkk83RaEr3EEuCni5dx9eq1kuT2dL1jngeQ7AHwRG9opVaokYUyQJIno+z5QBWXJsTBY63McwDckCwBlsn8ZQxYSgB3+v/BruMPUHXOjUPf9qD2O++6Pm3woJa+U8QdoWUBjGXPA/Bm5pMUiYStAVZUYCGi4jVBxGnQn6MLONDUhap6N6qd3ah2dZK6sOdMB2oa3JDVQgCjcc5cB1A2B1glgJcE8CoKBGJpQX2bKrH7dDtqzndjf1YVBHDI2VFQAStzPk22AV5R9lyBJA18OhHAgfNe1Ljy5vubvPhEADwsAiAZAFLrsgUQhm4ep9fxuVV89kMv9jk7ydgrzPc1erC34RFVoB21BLBxCcwy3wgQDm8CEOHLIwW8oUqcvfYbKurcONjULcpfVdeBytNttPYd2HXsHg42tBsqUNyYxf2E+0c4vGYN8D8B0AHAyFQIlXUPaQN61813fHUTv4/M4L/nQTi+/AWVJ+8XAJgZ60raA+A+QMnD8+QZPj7VLgC45B98fRPux/9mH800DPme46MjtwuWwGiuAyTXZQsgnr023X88w4cnHtDm68LOI3fR0vlUGEmsrOlfPr+hAsWy3yJAItvl/h4PYOc3bbQMblTRuq/EJGEUl1XqkCokRTc2AzCa2wbgyzdKbZj2IY7+3A/H56344kKvMJFJSQJIkSRSWlENS5BEMslKFFUmI2N1dcUagG/ttZRehWA4ju+v/wrH4Rv48dYTjPlDIDZQAQgGlL2+X3J3gd2wBOBQsj+MxWKIx+PiKcZKXG4e29vbU1Q9Pbr6+vrg8XjMAS5eulLyddzS2opy/wq+BTgoCRlpZOGDAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"aa51403116692fc1be9782027bd4158c08c5c2b36545cb3fb8096d1af3e95d2b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1791509309826,"unified_at":"2026-10-09T01:28:29.826Z","metadata":{"hashes":{"sha256":"aa51403116692fc1be9782027bd4158c08c5c2b36545cb3fb8096d1af3e95d2b","sha1":"abedf502f4f6448b61b55cff8fdf63277248d48c","md5":"3546bdab9151e1823f47b4256a53db2a","sha512":"05875c053c9167c4a093c2f631f2807bdbce461022fcc90e8f2df77c5af2e5158b76b5b913f000a63b50819238a2edfb72123ed42c3f00ede4a0ad4e34e79a7d","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://zenodo.org/record/4255110","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1604714332000,"last_seen":1659565877000,"last_multi_scan":1659565877000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":3},"sandbox_signatures":{"informative_count":12,"suspicious_count":4,"malicious_count":0,"total":16},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-classification","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/","report_link":"https://urlscan.io/result/5bf9f083-f7bd-436f-aa4d-3f920cee2ee4/","extra_fields":[{"name":"percent","value":0}]}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.sectigo.com\"\n \"ocsp.pki.goog\"\n \"crt.usertrust.com\"\n \"cdnjs.cloudflare.com\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"m.addthis.com\"\n \"piwik.web.cern.ch\"\n \"s7.addthis.com\"\n \"v1.addthisedge.com\"\n \"z.moatads.com\"\n \"zenodo-broker.web.cern.ch\"\n \"zenodo.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"137.138.76.77:443\"\n \"23.54.162.144:80\"\n \"104.16.19.94:443\"\n \"172.217.2.106:443\"\n \"23.46.200.29:443\"\n \"142.250.73.195:80\"\n \"172.217.2.99:443\"\n \"23.52.163.40:443\"\n \"188.184.101.64:443\"\n \"91.199.212.52:80\"\n \"188.185.82.144:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\InternetShortcutMutex\"\n \"IsoScope_9e8_IESQMMUTEX_0_519\"\n \"IsoScope_9e8_IESQMMUTEX_0_303\"\n \"UpdatingNewTabPageData\"\n \"IsoScope_9e8_ConnHashTable<2536>_HashTable_Mutex\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2536\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"IsoScope_9e8_IESQMMUTEX_0_331\"\n \"IsoScope_9e8_IE_EarlyTabStart_0xc18_Mutex\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9e8_IESQMMUTEX_0_519\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00067354-00002536) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://zenodo.org/record/4255110\" (UID: 00067354-00002536)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2536 CREDAT:275457 /prefetch:2\" (UID: 00067492-00003868)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://zenodo.org/record/4255110\" (UID: 00067354-00002536)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2536 CREDAT:275457 /prefetch:2\" (UID: 00067492-00003868)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"Network Related","name":"Contacts Random Domain Names","description":"\"cdnjs.cloudflare.com\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4776 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/80 reputation engines marked \"https://zenodo.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"suspicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 137.138.76.77 on port 443 is sent without HTTP header\n TCP traffic to 23.54.162.144 on port 80 is sent without HTTP header\n TCP traffic to 104.16.19.94 on port 443 is sent without HTTP header\n TCP traffic to 172.217.2.106 on port 443 is sent without HTTP header\n TCP traffic to 23.46.200.29 on port 443 is sent without HTTP header\n TCP traffic to 142.250.73.195 on port 80 is sent without HTTP header\n TCP traffic to 172.217.2.99 on port 443 is sent without HTTP header\n TCP traffic to 23.52.163.40 on port 443 is sent without HTTP header\n TCP traffic to 188.184.101.64 on port 443 is sent without HTTP header\n TCP traffic to 91.199.212.52 on port 80 is sent without HTTP header\n TCP traffic to 188.185.82.144 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 13 domains and 13 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":31,"imported_dlls_count":135,"dropped_files_count":0,"extracted_files_count":51,"files_written_count":246,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":17,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":17,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":11,"dns_resolutions_count":13,"contacted_urls_count":6,"http_requests_count":6},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"sandbox_reports":[{"id":"5fa5ff5c3f9d4d650f5f9586","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["CHE","GBR","USA"],"submit_name":"aa51403116692fc1be9782027bd4158c08c5c2b36545cb3fb8096d1af3e95d2b.url","analysis_start_time":"2020-11-07T01:59:01+00:00","indicators_count":{"informative":12,"suspicious":4,"malicious":0},"tags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"137.138.76.77","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"address":"23.54.162.144","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"address":"104.16.19.94","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"address":"172.217.2.106","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"address":"23.46.200.29","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"address":"142.250.73.195","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"address":"172.217.2.99","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"address":"23.52.163.40","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"address":"188.184.101.64","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"address":"91.199.212.52","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"address":"188.185.82.144","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]}],"dns_resolutions":[{"domain":"cdnjs.cloudflare.com","address":"104.16.18.94","ttl":248,"country":"United States","registrar_organization":"CloudFlare, Inc.","registrar_name_servers":"NS3.CLOUDFLARE.COM","registrar_creation_date":"2009-02-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"crt.usertrust.com","address":"91.199.212.52","ttl":843,"country":"United Kingdom","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Comodo Group, Inc.","registrar_creation_date":"1997-12-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"fonts.googleapis.com","address":"172.217.0.42","ttl":213,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"fonts.gstatic.com","address":"216.58.194.195","ttl":175,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"m.addthis.com","address":"104.89.1.187","ttl":250,"country":"United States","registrar_name":"TUCOWS, INC.","registrar_organization":"Oracle Corporation","registrar_name_servers":"NS1.P27.DYNECT.NET","registrar_creation_date":"1998-05-26T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"ocsp.pki.goog","address":"142.250.73.195","ttl":133,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"ocsp.sectigo.com","address":"151.139.128.14","ttl":3481,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"piwik.web.cern.ch","address":"188.184.23.57","ttl":34,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"s7.addthis.com","address":"104.89.1.187","ttl":52,"country":"United States","registrar_name":"TUCOWS, INC.","registrar_organization":"Oracle Corporation","registrar_name_servers":"NS1.P27.DYNECT.NET","registrar_creation_date":"1998-05-26T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"v1.addthisedge.com","address":"104.89.1.187","ttl":3449,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"z.moatads.com","address":"23.52.163.40","ttl":9322,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"zenodo-broker.web.cern.ch","address":"188.184.28.138","ttl":59,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"domain":"zenodo.org","address":"137.138.76.77","ttl":21599,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]}],"http_requests":[{"host":"ocsp.sectigo.com","host_ip":"151.139.128.14:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEAx7F6ouVcdfk5QsSY4CTSE%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEAx7F6ouVcdfk5QsSY4CTSE%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.73.195:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.73.195:80","url":"/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEEpsSX8krXFHAgAAAAB%2FFIg%3D","method":"GET","header":"GET /gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEEpsSX8krXFHAgAAAAB%2FFIg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.73.195:80","url":"/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEC4Xlj0DtgFyCAAAAABgZcU%3D","method":"GET","header":"GET /gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEC4Xlj0DtgFyCAAAAABgZcU%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"host":"crt.usertrust.com","host_ip":"91.199.212.52:80","url":"/USERTrustRSAAddTrustCA.crt","method":"GET","header":"GET /USERTrustRSAAddTrustCA.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crt.usertrust.com","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"host":"ocsp.sectigo.com","host_ip":"151.139.128.14:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEHDSurvBDhHjOVfTCmFHLew%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEHDSurvBDhHjOVfTCmFHLew%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}],"processes":[{"pid":1756,"ppid":0,"name":"rundll32.exe","command_line":"\"%WINDIR%\\System32\\ieframe.dll\",OpenURL C:\\aa51403116692fc1be9782027bd4158c08c5c2b36545cb3fb8096d1af3e95d2b.url","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00066995-00001756","icon":"$2a"},{"pid":2536,"ppid":1756,"name":"iexplore.exe","command_line":"https://zenodo.org/record/4255110","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00066995-00001756","uid":"00067354-00002536"},{"pid":3868,"ppid":2536,"name":"iexplore.exe","command_line":"SCODEF:2536 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00067354-00002536","uid":"00067492-00003868"}],"all_imported_dlls":["credssp.dll","user32.dll","winmm.dll","dhcpcsvc6.dll","msctf.dll","wevtapi.dll","MSOHEV.DLL","api-ms-win-core-timezone-l1-1-0.dll","ieproxy.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","comdlg32.dll","WSHTCPIP.DLL","urlmon.dll","clbcatq.dll","netapi32.dll","ExplorerFrame.dll","setupapi.dll","sxs.dll","npmproxy.dll","ole32.dll","tzres.dll","mswsock.dll","devobj.dll","wshqos.dll","sqmapi.dll","webio.dll","slc.dll","deploy.dll","shell32.dll","sspicli.dll","Wpc.dll","cscapi.dll","profapi.dll","shlwapi.dll","dnsapi.dll","apphelp.dll","mlang.dll","ncrypt.dll","powrprof.dll","SwDir_1231201.dll","Wldap32.dll","secur32.dll","wkscli.dll","rpcss.dll","sechost.dll","api-ms-win-core-synch-l1-2-0.dll","wship6.dll","RpcRtRemote.dll","iertutil.dll","SensApi.dll","d3d11.dll","IPHLPAPI.DLL","rsaenh.dll","rasadhlp.dll","msvcr100.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","nlaapi.dll","srvcli.dll","msasn1.dll","msvcr90.dll","dhcpcsvc.dll","version.dll","IEShims.dll","ws2_32.dll","gpapi.dll","cryptnet.dll","DWrite.dll","comctl32.dll","cryptsp.dll","netprofm.dll","winhttp.dll","samcli.dll","mscorwks.dll","ieui.dll","schannel.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","jp2ssv.dll","msimtf.dll","ntshrui.dll","dxgi.dll","usp10.dll","bcrypt.dll","kernel32.dll","lpk.dll","imm32.dll","netutils.dll","wininet.dll","rpcrt4.dll","ntmarta.dll","userenv.dll","jscript9.dll","xmllite.dll","msvcrt.dll","d2d1.dll","t2embed.dll","ieframe.dll","bcryptprimitives.dll","ssv.dll","oleaut32.dll","cfgmgr32.dll","KernelBase.dll","nsi.dll","d3d10warp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","imagehlp.dll","wintrust.dll","oleacc.dll","oleaccrc.dll","mscoreei.dll","FWPUCLNT.DLL","mscoree.dll","linkinfo.dll","URLREDIR.DLL","npctrl.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","normaliz.dll","WindowsCodecs.dll","dui70.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","cryptbase.dll","uxtheme.dll","propsys.dll","mshtml.dll","UIAnimation.dll","winnsi.dll","crypt32.dll","advapi32.dll","dwmapi.dll","samlib.dll","gdi32.dll","duser.dll","msimg32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"32M6L796.txt","sha256":"3f3c38f67f060d056a830d3ea0333e0dc99ad362ae8956be44794806af2e6af2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"4W43WI2U.txt","sha256":"6893e77158fccee2e269eb27af46917040c37d0a462bd9ef1b2dd3d37a49bfca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"5G9PT7FI.txt","sha256":"5b224ba1942056e70371da4240f1db186076c9aa34ba68accbf51590015dbec9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"97G3OIF0.txt","sha256":"06e5ab01fd7e0ccb932332bd15b6bf8630d34c91713a533776b59363eaa7507e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"9RRY9A5F.txt","sha256":"80254b8e5332857636ad8cbca6f2fd9b056c64bb9803e6df45917affccbb5bd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"B27R1QHH.txt","sha256":"6f22d2c7103b14e07236945a5458a2a6ea203075cb4add63b6944ba0d0581e79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"B42QU7F5.txt","sha256":"3ea1aa1a24c75bf1f1301c93f23546a5d9de1f40488ee1569ae0314fa4d3a262","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"BIF7OJU2.txt","sha256":"fb27e20cfb7c6f3a1d3bb32f5b353d875e57b455cd94bf2a8273dc620d364332","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"BOXNTV7A.txt","sha256":"e386a149b091c7157862610410bd312da99d2cf342c2778f87f3e35fd8cf4e73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"FLY9T119.txt","sha256":"a4549eb3b3322f35320b819a5e181fbe45a0140375ba4c948e4adc6023fa025c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"G1SL4UXI.txt","sha256":"803ebe9dd4468032a96fba9f1cfb081a37c04fa6e942f293dcb296a95db9ccb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"PYGE03WV.txt","sha256":"51dc4e26ae453706231f094c1c30d87d5f78bd6ec7b934480a79d2506b3ae758","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"RFG8YCY1.txt","sha256":"c93c6bee169b34e7f0e36af52533c7141961bf9f3cf5938f710dd457df786bb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"S6VNCALY.txt","sha256":"2437f3f0d6641148b51cb038a804ecfa1bb67ea42b3312213b25a5632f870d7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"TBBI2EVS.txt","sha256":"686a045d983c95bd1409018d94d47922e88ddc750b0a8afe0d5baebd3de088e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"YMG1ZHGE.txt","sha256":"fd2ec8cadbcc1855222138d9e48f32e25a86728b3f4145f9405b0d7c0e76af45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"5YDLY0P7ZBZ9QU8Q552T.temp","sha256":"faf464279376e1abb3731de85f6e87dda3be8cf2b0984eee9316ca9d69ee0104","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"en-US.3","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sha256":"e587a1f90ff0ad8db8e584c076fb3eb043c5265bffbc7d6c74b3ebb2f1bf2e29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27","sha256":"159e7bd883fa940ed464d9385ac0424c699e0308423dc91b74e418978f79a5e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sha256":"544457c9a288c2ee9ae58b526ee7392ae995bbef365b0785bc14a99d6c2e6232","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"72BA427A91F50409B9EAC87F2B59B951_45B6E8066773AEA91624AF42E4F02749","sha256":"79df02ea541623f32dd78193a7feb8ce02ba7cdd20b98519400a2364dea990e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B","sha256":"5dfaa68f924704e1c0a1e017d2956b79c83ddd895397a3f849816af33dc82eb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"24e3d3c91eb81d875158efcc181ef4c92835dddf57998783b3eeb4b608192237","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"61F579715F0F12660D8EE8F78F6ED508","sha256":"ac9364e55e58ef1e062fabb12795faaca1ab0678d166e081a77a91de6ab772ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sha256":"ce4e6be6a3eadd507283b00b32859b9445794fbd6df8ced34be28af5ad9974c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sha256":"113c9f1873a002433d4e522140d318f36b160908f83b488df46c022755daf7a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sha256":"a1deecc74ce3a7e7b34beebcb7d722e2af46e2e678ad61a117890ff0ae3f34d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E","sha256":"2c01ba329cfb39b6141b3c98d662ba24eb458e051fb7de79f975e681e8b4327a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"B398B80134F72209547439DB21AB308D_5FDD03068CBBD8A96F3AB9595BA10093","sha256":"51c107c12d411a2abe0bf8ca90cf9ba04a89d6e7924b7396d604b02da99b3b69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"CC197601BE0898B7B0FCC91FA15D8A69_A638509B88EE2AB37C10D517271B81E3","sha256":"b00855757e9147d18a5524dd4138e90018caaa9ac927f558c3d3d19c64438a5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"CC197601BE0898B7B0FCC91FA15D8A69_F14731947ED657378B39F5C9C0C64AB9","sha256":"deb02dd5eda737aab7a2083575af5c4f135a452c9a5eb16d9e8c8b326d050721","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sha256":"1fdc7d5c24ebe80f252f938f576632e9c543616f75c80a953161547188c83dda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"E0968A1E3A40D2582E7FD463BAEB59CD","sha256":"68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"JavaDeployReg.log","sha256":"3162d3a36235451039e3c32cccd189faa696e1792bfc8cb59666efb84da4286a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"dat9CFE.tmp","sha256":"f476ae4e0204e1e6415d024dd7ec3438db1d198ad89c7308be937c5bcbee7fda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"dat9E17.tmp","sha256":"b277380c30171716293269299f87da223302111b47b089533cd1c88ed952aa1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"dat9E67.tmp","sha256":"1d6536f5ad74fdf3ca625d751d175be29dce13fe7038e34186d788ac4cf5f4bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"dat9E87.tmp","sha256":"f39f72ef252166b84032abd8962fd8f8299ba042e9c04cdb717370a98c2f6166","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"dat9EE6.tmp","sha256":"0ca14a20f0368b8df2e5801350237dbd152dbb343b8fef84f6d99cb25ee96928","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"dat9F15.tmp","sha256":"86a0d9c2ec425c25096d6fc88690f07170812e8abc19547c79ee9e2aa5b0add8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"dat9F55.tmp","sha256":"efb26c11c6271cee926b57d33dbbf68d00cd10859ac4c096af11d1dc0fbfe365","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"datA050.tmp","sha256":"274aafccf37f12c3db159f2cfdfb3291016c270c89b2f6a6b59edcb7f0ff482b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"datA1A9.tmp","sha256":"53f974a0874d506d0cbb489a4a02a5b218fb3f25f771da9ae795651ebb26a1bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"datA1C9.tmp","sha256":"83eefa09b706530544aeeb1b50f6799f4454de0d3a1cc08a112a07489f5d99fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"datA1DA.tmp","sha256":"094c23d49bac88e56727ca281c68c57e53574010eb02fb3212271695446fedb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"datA209.tmp","sha256":"04e88c975bbd5d946e18d0cb8529716b2c339f263da0ce576ccebc4899184d85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"~DF0CB5A8E1CCE76F8E.TMP","sha256":"9fd86b8f41597b723ac2e4ee0465dda47a2f33c7c85aae7b6b9e831b4815bdc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"~DF35B34BFD515685B6.TMP","sha256":"f82198ce922ac8a58f5ab27491af736792f32ca4e77665d5ef1b63c2b80b9357","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"~DF885286D3C7DEA7A6.TMP","sha256":"fa6648292465e20692b7549bdc2b8dc36bb08796cce08dd0609fe1f8d3bcdf5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]}],"files_written":[{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\~DF8FC1862C36DC6D18.TMP","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_6F8900FF5837CB8DFA61275648785329","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\572BF21E454637C9F000BE1AF9B1E1A9","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\97G3OIF0.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"C:\\https:\\zenodo.org\\record\\4255110","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0MYAT1N3.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NIFFDOLS.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\zenodo.3867f39d[1].css","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\zenodo.search.ff7bb1ad[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\3mt7jhv\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\openaire-horizontal-old[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\zenodo.f843b7ec[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_F14731947ED657378B39F5C9C0C64AB9","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_1423DAB666B1677332423598CD6EF306","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC4FEA46495CA161D470CD085EDBAADE","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CC197601BE0898B7B0FCC91FA15D8A69_A638509B88EE2AB37C10D517271B81E3","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\KFOkCnqEu92Fr1MmgVxIIzQ[1].woff","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\KFOmCnqEu92Fr1Mu4mxM[1].woff","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9RRY9A5F.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\fontawesome-webfont[1].eot","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\TeX-AMS-MML_HTMLorMML[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_1374AC543829516A5CA56081CD00C32A","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\32M6L796.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\moatframe[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\Adobe\\Director\\SwDir_1231201.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CI1NEHIQ.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E0968A1E3A40D2582E7FD463BAEB59CD","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E0968A1E3A40D2582E7FD463BAEB59CD","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_7615FEE94EC76D87B786C0D82C9D525A","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\72BA427A91F50409B9EAC87F2B59B951_E09C81BD3447BF6A966CBDB3387B018B","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\AEB3247079FFA7BF2B5622D101414A7E","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\111.e2e4eb4afc8f8e2af051[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\37.d9ae5fc21339c037239e[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\count[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\selectbox[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\piwik[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\searchbar[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\error[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\error[2].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\loading[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\pdfjs.d6478300[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\texture[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\toolbarButton-zoomOut[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\piwik[1].gif","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\toolbarButton-sidebarToggle[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\toolbarButton-pageUp[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\toolbarButton-secondaryToolbarToggle[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\toolbarButton-viewOutline[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\pdf.worker[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\locale[1].properties","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RFG8YCY1.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\viewer[1].properties","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\S6VNCALY.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\shadow[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\loading-icon[1].gif","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\latha.ttf","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\verdana.ttf","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{E9AA41B0-2094-11EB-8E9C-080027F86845}.dat","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\~DF35B34BFD515685B6.TMP","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YMG1ZHGE.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TBBI2EVS.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VG8BU31O.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IYXGE11F.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HGEILYKK.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\search[1].json","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_649D3C9717A1D0B02735FC14F09C533D","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3538626A1FCCCA43C7E18F220BDD9B02","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\61F579715F0F12660D8EE8F78F6ED508","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\AE19CB9A54B9AFCCEF586AA30460FF1F","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\61F579715F0F12660D8EE8F78F6ED508","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\4255110[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_276151B6A55B03FE802FD87EEDF5637F","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\~qitkurh.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_5FA8E5E800867BF860DF5E533E701BAF","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_5FDD03068CBBD8A96F3AB9595BA10093","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_58110001BD802D59A2C1E2F55B0788BA","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\zenodo[1].svg","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\B42QU7F5.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\cern[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\openaire[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B398B80134F72209547439DB21AB308D_5FDD03068CBBD8A96F3AB9595BA10093","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\eu[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\MathJax[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\addthis_widget[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CC197601BE0898B7B0FCC91FA15D8A69_F14731947ED657378B39F5C9C0C64AB9","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\css[1].css","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3S9Q96YC.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_A638509B88EE2AB37C10D517271B81E3","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_72CCC6DF3688E98B1C2EF6F8C3A9AB59","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\KFOlCnqEu92Fr1MmSU5fBBc-[1].woff","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\KFOlCnqEu92Fr1MmWUlfBBc-[1].woff","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\KFOkCnqEu92Fr1Mu51xIIzQ[1].woff","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\simsun.ttc","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\msmincho.ttc","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\123mo-vies-wa-tch-holidate[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\HVI1ZDNF\\zenodo[1].xml","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PYGE03WV.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash32_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%PROGRAMFILES%\\Microsoft Silverlight\\5.1.50907.0\\npctrl.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\1[1].txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\72BA427A91F50409B9EAC87F2B59B951_45B6E8066773AEA91624AF42E4F02749","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\72BA427A91F50409B9EAC87F2B59B951_45B6E8066773AEA91624AF42E4F02749","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\facets[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\pagination[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\results[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\citeproc[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\typeahead[1].htm","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\pdfjs.f89afa04[1].css","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\fullscreen.b4bfa37e[1].js","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\relationships[1].json","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5G9PT7FI.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BOXNTV7A.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\G1SL4UXI.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\toolbarButton-menuArrows[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\toolbarButton-viewThumbnail[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\toolbarButton-zoomIn[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\toolbarButton-search[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\toolbarButton-pageDown[1].png","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\123mo-vies-wa-tch-holidate[1].pdf","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\dat9CFD.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\dat9CFE.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\dat9E17.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\dat9E67.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\dat9E87.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\dat9EE6.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\dat9F15.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\dat9F55.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\datA050.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\datA1A9.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\datA1C9.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\datA1DA.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\datA209.tmp","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\Fonts\\cour.ttf","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\en-US\\d2d1.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4W43WI2U.txt","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{C5D18687-2094-11EB-8E9C-080027F86845}.dat","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{C5D18689-2094-11EB-8E9C-080027F86845}.dat","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%TEMP%\\~DF9415075FE0BD754E.TMP","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\D1EB23A46D17D68FD92564C2F1F1601764D8E349\\D1EB23A46D17D68FD92564C2F1F1601764D8E349","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LOWREGISTRY\\ADDTOFAVORITESINITIALSELECTION\\ADDTOFAVORITESINITIALSELECTION","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LOWREGISTRY\\ADDTOFEEDSINITIALSELECTION\\ADDTOFEEDSINITIALSELECTION","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"IsoScope_9e8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"IsoScope_9e8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"IsoScope_9e8_ConnHashTable<2536>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2536","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"IsoScope_9e8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"IsoScope_9e8_IE_EarlyTabStart_0xc18_Mutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9e8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"Local\\https://zenodo.org/","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"IsoScope_9e8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9e8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://zenodo.org/","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5fa5ff5c3f9d4d650f5f9586"}]}]}},"report_ids":{"sandbox_job_ids":["5fa5ff5c3f9d4d650f5f9586"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Sample aa5140311669… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample aa5140311669…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/aa51403116692fc1be9782027bd4158c08c5c2b36545cb3fb8096d1af3e95d2b"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample aa5140311669… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample aa5140311669…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/aa51403116692fc1be9782027bd4158c08c5c2b36545cb3fb8096d1af3e95d2b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample aa5140311669… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample aa5140311669…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]