24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c478913dd84c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c478913dd84c…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":29},"behavioralIndicators":{"malicious":6,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tc1c,"fastfuzzer.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Wed Feb 1 01:54:20 2017 mtime=Wed Feb 1 01:54:20 2017 atime=*Invalid time* length=4044681862 window=showmaximizedshownoactivateshowminnoactiveshownashowdefault" "Eula.exe" has type "MS-DOS executable" "Calculator.lnk" has type "MS Windows shortcut Has Description string Has Relative path Icon number=1844647142 Archive ctime=Tue Jul 14 05:41:28 2009 mtime=Tue Jul 14 05:41:28 2009 atime=*Invalid time* length=166748949 window=hideshowminimizedshowmaximizedshownoactivaterestoreshowdefault" "al.exe" has type "MS-DOS executable MZ for MS-DOS" "Adobe Reader XI.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Icon number=-1540233964 Archive ctime=Fri Sep 12 15:43:08 2014 mtime=Sun Feb 15 18:29:10 2015 atime=*Invalid time* length=3231537270 window=hideshownoactivateshowminnoactiverestoreshowdefault" "FlashPlayerApp.exe" has type "MS-DOS executable" "AcroExt.exe" has type "MS-DOS executable" "Examples.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Directory ctime=Sun Feb 15 18:27:28 2015 mtime=Sun Feb 15 18:27:28 2015 atime=*Invalid time* length=2333386107 window=hideshowminimizedminimizeshowminnoactiverestoreshowdefault" "dumpbin.exe" has type "MS-DOS executable" "Event Viewer.lnk" has type "MS Windows shortcut Has Description string Has Relative path Has Working directory Has command line arguments Icon number=-677381942 Archive ctime=Tue Jul 14 03:46:10 2009 mtime=Tue Jul 14 03:46:10 2009 atime=*Invalid time* length=171357841 window=normalshowminimizedshowmaximizedminimizerestoreshowdefault" "Desktop background.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Fri Apr 22 03:17:38 2016 mtime=Fri Apr 22 03:17:38 2016 atime=*Invalid time* length=621256707 window=hidenormalshowmaximizedminimizeshowminnoactiveshowdefault" "capinfos.exe" has type "MS-DOS executable" "dH1rDN9f9.doc" has type "data" "Google Chrome.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Icon number=1265997204 Archive ctime=Wed Feb 1 01:59:02 2017 mtime=Wed Feb 1 01:59:02 2017 atime=*Invalid time* length=4095501171 window=hideshowminimizedshowmaximizedshownoactivateminimizeshowminnoactiveshownarestoreshowdefault" "GoogleUpdateSetup.exe" has type "MS-DOS executable" "dbh.exe" has type "MS-DOS executable" "cordbg.exe" has type "MS-DOS executable" "DW20.EXE" has type "MS-DOS executable" "Command Prompt.lnk" has type "MS Windows shortcut Has Description string Has Relative path Has Working directory Icon number=712456604 Archive ctime=Tue Jul 14 05:22:09 2009 mtime=Tue Jul 14 05:22:09 2009 atime=*Invalid time* length=1559825448 window=hidenormalshownoactivateminimizeshowminnoactiverestoreshowdefault"26:T6c7,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23c.dat" ".exe" touched file "C:\Windows\System32\l_intl.nls" ".exe" touched file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp" ".exe" touched file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp" ".exe" touched file "C:\Windows\System32\rsaenh.dll"27:T840,"vchost.exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\ose.exe" with delete access "vchost.exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\setup.exe" with delete access "vchost.exe" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE" with delete access "vchost.exe" opened "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Liesmich.htm" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroBroker.exe" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\AcroExt.exe" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32Info.exe" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroTextExtractor.exe" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\arh.exe" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\AdobeID.pdf" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\DefaultID.pdf" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\AdobeID.pdf" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\DefaultID.pdf" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\Legal\DEU\license.html" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\Legal\ENU\license.html" with delete access "vchost.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\LogTransport2.exe" with delete access28:T159a,".exe" wrote bytes "13301200170000000600001102037d0f000004002a2b0a064501000000ebffffff002a" to virtual address "0x00A66324" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "133011003900000019000011027b120000040a180b2b06d04800000626074503000000ddffffff0000000004000000062a2b0a170b2be6d014000004260014a5040000012a" to virtual address "0x00A66460" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "13301200270000000600001102037d11000004170a2b08d010000004180a26064502000000dfffffff00000000002a2b00002a" to virtual address "0x00A6642C" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "133011002400000008000011007e050000046fb400000a0a2b00062a2b0a074501000000e4ffffff0014a5020000022a" to virtual address "0x00A633E8" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "13301100520000000a00001100170b2b12d00c000006208fbe5d712036482768610b26074503000000d7ffffff000000001d0000007e070000046fb600000a0a180b2bdfd00400000418162e03262b012601062a2b000014a5050000022a" to virtual address "0x00A63468" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "1330120057000000100000110003fe160700001b6fbd00000a180b2b06d00900000426074504000000d3ffffff00000000040000000f000000002a2b2400190b2be1d00900000426031200fe150700001b06810700001b170b2bc8d01600000626002a" to virtual address "0x00A63B28" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "133011002000000013000011000228120100060a2b00062a2b0a074501000000e8ffffff0014a55d0000012a" to virtual address "0x00A63CA8" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "13301200270000000600001102037d1200000400170a2b08d0420000061b0a26064502000000deffffff000000002a2b00002a" to virtual address "0x00A664A8" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "133012004a0000001000001100170b2b08d006000002190b26074503000000e1ffffff0000000026000000031200fe150700001b06810700001b00180b2bdad006000002201d67706b20f4973f77610b262a2b00002a" to virtual address "0x00A63EF4" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "133011004800000006000011000228ac00000a170a2b0ed0030000021c1b3103262b012601064503000000d5ffffff00000000180000000000180a2be8d00600000620be28464e202b0b6a3f5a0a262a2b00002a" to virtual address "0x00A632B0" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "133011004a00000013000011000228120100060a180b2b0ed006000002181b3003262b012601074503000000d4ffffff0000000004000000062a2b12170b2be6d01d0000061b1a2e03262b0126010014a55d0000012a" to virtual address "0x00A63DC4" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "bfa281c3" to virtual address "0x6CF81FDC" (part of module "MSCORWKS.DLL") ".exe" wrote bytes "db4dbc6d00000000" to virtual address "0x00A62000" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "13301100420000000600001173c400000a800d000004170a2b12d02400000620740502702081b2b144580a26064503000000ceffffff000000000b00000000180a2be9d00e000004262a2b00002a" to virtual address "0x00A64040" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "1330110017000000060000110228a800000a00002a2b0a064501000000ebffffff002a" to virtual address "0x00A6328C" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "133011002e00000006000011000228be00000a0000170a2b0ed00b0000041e1e3103262b012601064502000000d7ffffff000000002a2b00002a" to virtual address "0x00A63B8C" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "133011004800000006000011000228be00000a180a2b12d006000002207282c40d206880625b590a26064503000000d1ffffff0000000004000000002a2b1300170a2be5d006000002161c2e03262b012601002a" to virtual address "0x00A63F4C" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "133011002600000006000011000228be00000a0000170a2b06d01f00000626064502000000dfffffff000000002a2b00002a" to virtual address "0x00A6400C" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "13301100480000000b000011007e080000046fb700000a0a170b2b0ed00a00000618163303262b012601074503000000d0ffffff000000000c000000180b2bead005000004190b26062a2b000014a5060000022a" to virtual address "0x00A634C8" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE") ".exe" wrote bytes "13301200400000000e0000110002032806010006280a0100060a170b2b12d00e000006207f00f6232068585553610b26074502000000ceffffff000000002b00062a2b000014a56f0000012a" to virtual address "0x00A63BC8" (part of module "C478913DD84CE396F66CEFA88E23588100AAB951FF1B01AAC9EA72FAC12611B1.EXE")29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790808792967,"unified_at":"2026-09-30T22:53:12.967Z","metadata":{"hashes":{"sha256":"c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1","sha1":"12229b3146cf3f69dcc3593e2b393c4471c81b52","md5":"f61b96dfde28683ce4b2dfe07accddbc","sha512":"77ac16378075f20f3950fcf8f8a1a39542f9ed06173fecea96e4b8b7acb6fd1697568df237b50a7a0a79ef531b85c1d34d1fe2697fe00e293d0edaedc330922e","ssdeep":"6144:zAe/hNCGZsvv2yl78bQSOk1vI5DbhC1Cv0G:0eZNJZ02yl7AGk1vINwA","ssdeep_chunks":["6144:zAe/hNC","6144:Ae/hNCG","6144:e/hNCGZ","6144:/hNCGZs","6144:hNCGZsv","6144:NCGZsvv","6144:CGZsvv2","6144:GZsvv2y","6144:Zsvv2yl","6144:svv2yl7","6144:vv2yl78","6144:v2yl78b","6144:2yl78bQ","6144:yl78bQS","6144:l78bQSO","6144:78bQSOk","6144:8bQSOk1","6144:bQSOk1v","6144:QSOk1vI","6144:SOk1vI5","6144:Ok1vI5D","6144:k1vI5Db","6144:1vI5Dbh","6144:vI5DbhC","6144:I5DbhC1","6144:5DbhC1C","6144:DbhC1Cv","6144:bhC1Cv0","6144:hC1Cv0G","12288:zAe/hNC","12288:Ae/hNCG","12288:e/hNCGZ","12288:/hNCGZs","12288:hNCGZsv","12288:NCGZsvv","12288:CGZsvv2","12288:GZsvv2y","12288:Zsvv2yl","12288:svv2yl7","12288:vv2yl78","12288:v2yl78b","12288:2yl78bQ","12288:yl78bQS","12288:l78bQSO","12288:78bQSOk","12288:8bQSOk1","12288:bQSOk1v","12288:QSOk1vI","12288:SOk1vI5","12288:Ok1vI5D","12288:k1vI5Db","12288:1vI5Dbh","12288:vI5DbhC","12288:I5DbhC1","12288:5DbhC1C","12288:DbhC1Cv","12288:bhC1Cv0","12288:hC1Cv0G","6144:0eZNJZ0","6144:eZNJZ02","6144:ZNJZ02y","6144:NJZ02yl","6144:JZ02yl7","6144:Z02yl7A","6144:02yl7AG","6144:2yl7AGk","6144:yl7AGk1","6144:l7AGk1v","6144:7AGk1vI","6144:AGk1vIN","6144:Gk1vINw","6144:k1vINwA"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":280576,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1546954032000,"last_seen":1655561659000,"last_multi_scan":1655561659000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":14,"suspicious_count":18,"malicious_count":6,"total":38},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1227356","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.180340","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.180340 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.JFQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050f8ae1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Xorist.ln","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Xorist.flnott","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Xorist-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.DN-Boom.280576","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.BFJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Xorist","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll\" at 00026446-00002468-0000010C-15495683849\n \".exe\" queries volume information of \"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll\" at 00026446-00002468-0000010C-15497446197","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TEMPSVCHOST.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TEMPSVCHOST.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"92.122.218.10:80\"\n \"23.57.4.240:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"vchost.exe\" created file \"%TEMP%\\43n4D0OiE53Z35X.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 6C480000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \".exe\" touched \"UsersFiles\" (Path: \"HKCU\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")\n \".exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")\n \".exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\SHELLFOLDER\")\n \".exe\" touched \"Shell File System Folder\" (Path: \"HKCU\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\INPROCSERVER32\")\n \".exe\" touched \"Security Manager\" (Path: \"HKCU\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"vchost.exe\" (UID: 00027803-00003460)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"vchost.exe\" (UID: 00027803-00003460)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00026446-00002468-00000105-14411266853","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"/5MAmvm8 with unusual entropies 7.61057887768","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Links\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Saved Games\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Eula.exe\" has type \"MS-DOS executable\"\n \"al.exe\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"FlashPlayerApp.exe\" has type \"MS-DOS executable\"\n \"AcroExt.exe\" has type \"MS-DOS executable\"\n \"dumpbin.exe\" has type \"MS-DOS executable\"\n \"capinfos.exe\" has type \"MS-DOS executable\"\n \"GoogleUpdateSetup.exe\" has type \"MS-DOS executable\"\n \"dbh.exe\" has type \"MS-DOS executable\"\n \"cordbg.exe\" has type \"MS-DOS executable\"\n \"DW20.EXE\" has type \"MS-DOS executable\"\n \"FlashPlayerUpdateService.exe\" has type \"MS-DOS executable\"\n \"AutoIt3Help.exe\" has type \"MS-DOS executable\"\n \"aspnet_wp.exe\" has type \"MS-DOS executable MZ for MS-DOS\"\n \"ehExtHost.ni.exe\" has type \"MS-DOS executable\"\n \"dumpchk.exe\" has type \"MS-DOS executable\"\n \"agestore.exe\" has type \"MS-DOS executable\"\n \"editbin.exe\" has type \"MS-DOS executable\"\n \"firefox.exe\" has type \"MS-DOS executable\"\n \"ComSvcConfig.ni.exe\" has type \"MS-DOS executable\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"vchost.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"vchost.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ALCMETER\"; Value: \"%TEMP%\\43n4D0OiE53Z35X.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 92.122.218.10 on port 80 is sent without HTTP header\n TCP traffic to 23.57.4.240 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"Oooooops All your files have been encrypted\nAnd to encode the files, enter the password\nto get a password\nSearch in Facebook\nMy name = Mohamed Naser Ahmed\nmy ID = 100027091457754\nsee you soon\" (Source: 00027803-00003460-0000018C-36457827276, Indicator: \"files have been encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1998 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"vchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1.bin\" claimed CRC 3310257559 while the actual is CRC 317516","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/71 Antivirus vendors marked sample as malicious (63% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"45/71 Antivirus vendors marked sample as malicious (63% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"56/71 Antivirus vendors marked spawned process \"vchost.exe\" (PID: 3460) as malicious (classified as \"Trojan.Ransom\" with 78% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%TEMP%\\vchost.exe\" (Handle: 1004)\n \".exe\" wrote 52 bytes to a remote process \"%TEMP%\\vchost.exe\" (Handle: 1004)\n \".exe\" wrote 4 bytes to a remote process \"%TEMP%\\vchost.exe\" (Handle: 1004)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"HOW TO DECRYPT FILES.txt\" which has been seen in the context of ransomware (Indicator: HOW TO DECRYPT FILES.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":168,"files_written_count":453,"files_deleted_count":0,"registry_keys_created_count":9,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5c34a5307ca3e1506b7a1be3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Xorist","contacted_countries":["EU","USA"],"submit_name":"c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1","analysis_start_time":"2019-01-08T07:27:22+00:00","indicators_count":{"informative":14,"suspicious":22,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"92.122.218.10","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"address":"23.57.4.240","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}],"processes":[{"pid":2468,"ppid":0,"name":"c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1.exe","command_line":"","sha256":"c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1","normalized_path":"C:\\c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1.exe","uid":"00026446-00002468","icon":"$29"},{"pid":3460,"ppid":2468,"name":"vchost.exe","command_line":"","sha256":"ccf9fc1e207251e05237f6359fc6d160666e594c783756159d67c18a80145a0c","normalized_path":"%TEMP%\\vchost.exe","parent_uid":"00026446-00002468","uid":"00027803-00003460"}],"all_imported_dlls":["imm32.dll","mscorlib.ni.dll","mscorjit.dll","Culture.dll","msasn1.dll","cryptbase.dll","comctl32.dll","ntmarta.dll","nsi.dll","mscoree.dll","KernelBase.dll","msvcrt.dll","WindowsCodecs.dll","RpcRtRemote.dll","setupapi.dll","urlmon.dll","wininet.dll","bcrypt.dll","advapi32.dll","msvcr80.dll","shdocvw.dll","kernel32.dll","rpcrt4.dll","msctf.dll","shell32.dll","profapi.dll","rsaenh.dll","devobj.dll","gdi32.dll","GdiPlus.dll","ws2_32.dll","msvcr100.dll","usp10.dll","ntdll.dll","Microsoft.VisualBasic.dll","version.dll","propsys.dll","clbcatq.dll","apphelp.dll","cryptsp.dll","iertutil.dll","Wldap32.dll","crypt32.dll","sechost.dll","user32.dll","lpk.dll","uxtheme.dll","oleaut32.dll","mscoreei.dll","System.Drawing.ni.dll","dwmapi.dll","cfgmgr32.dll","shlwapi.dll","mscorwks.dll","ole32.dll","System.ni.dll","mscorrc.dll","sspicli.dll","System.Windows.Forms.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"dumpbin.exe","sha256":"9b40a7474a6cd459bcbee80dd3bfb5876f15177dc4628fa5ad82bdc734e16104","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AcroExt.exe","sha256":"6a569496499f51220108834b45a83f721f3e3f4269932d3bc5f3df090ec9ee34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AcroRd32.exe","sha256":"3fdb354bba2ca26f5c00986187ae93cc3aeeb5f3ee17b95b3dfcd1c24a41dda6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AdobeCollabSync.exe","sha256":"e39b34eb8b6798383068f3f9b81faf1a99dd56917483b5868757248fb407eb71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Eula.exe","sha256":"64c1263f9bce54352c9a21e20fb26542026dcc2fbad4227e0ec7733774e4c54d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AdobeID.pdf","sha256":"a58c23a46df7c64a7eedf32e57767276c0f2bdb12951b50a7002046bc366329a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"DefaultID.pdf","sha256":"0cf768900af7cfd2de4fa8d6e4ae0292ee5c0ff8d0484e75ef4c1695892fd937","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"add_reviewer.gif","sha256":"4c00a9f09ca694c1fda292b86810735d1996bb4f564ce9ad1aea8e6af958dea4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"bl.gif","sha256":"f3a0207ffcc3756a064d1680c063d1b065e5b49b77e2e96dd317cd5998ba7ac0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"br.gif","sha256":"d54a0922f207d9da80044d03f49b7129ca5425967a557e515942318c2bd5b797","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"create_form.gif","sha256":"bea45f5acea9ace80ad1009b0a4304ac6dbae5e335ff9c316bd025ca784b2661","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"distribute_form.gif","sha256":"fab08d13385d79b53553eaa01d65f4cbbe1ba28dcf750b8ac7234dbfcc87943a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"email_all.gif","sha256":"fd2f9ba773a0d419ab1fe157595c0298a4e5d66207609f69b4e6355be1a3de0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"email_initiator.gif","sha256":"d4e8f2217dbc4b75cd939206df123c7fcb822004244fdfa4349a630cd16d2c51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"end_review.gif","sha256":"1a0192612abe209a965d667cbd5fcc99e0cc86ce98a2b1dbb21d2c09f8a6bdf9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"ended_review_or_form.gif","sha256":"db937e7c244f82c2ae0c622f74af99142a0d07e64566ef7ed4011973111445fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"forms_distributed.gif","sha256":"a664e657975a3642d417ea5c4d440d350ee8bc29b548d321742661d6da5a88b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"arh.exe","sha256":"d17247165307a9a5daeaf48c7a41184cbf9a739180c8694e6065636d0cd58879","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Dynamic.pdf","sha256":"24890d9ef275e37140928542072cbce602c080c8ef15e6c11b67b43fe76d9f4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"ENUtxt.pdf","sha256":"ad399a1096c2c86b0d1284687ede1528cdf6c1552c919341f37183f20e7f562e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"CENTEURO.TXT","sha256":"dc08b67b506a05ddfa437a5dd3b6fab234860c946b9866ac2e1081e728c4d98b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Application Verifier.lnk","sha256":"3bdc16f5f54991874f830d2913caf88b83017178e4f521e54be059056429f8d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Au3Info.exe","sha256":"1278cc33bbdb304b73bf33ab52f4f057c6eb2d08b824a119822515b868b911d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Au3Info_x64.exe","sha256":"2e888c02befeb0cf41905b67d785588fff518b6ba292c613e9301a827b4bc76b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Aut2exe.exe","sha256":"d5e5849ccde2ce495de06c0fb00c50d76c11892b073caff5ce80ba007a4ace87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Aut2exe_x64.exe","sha256":"3705cd57355f3501beca50725ffe2bc399ea23f207877a6f32d42d0896724bc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AutoIt3Help.exe","sha256":"5c9bc831187076db6a470081543f0c455f8c15e33cd46ca23f3b73b3caa5daf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AutoIt3_x64.exe","sha256":"8007c304ab13a7820c34a25ebed7b4269dcb4ed9f6506fd4196e3008942ae311","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"_Excel1.xls","sha256":"1ee2c548d649e69280bca851bf36c99fa7e5cdf76cfe55ccffb2acffa6f2bca5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"_Excel2.xls","sha256":"b42159a73225781ffb5416f4fbc0521a0b1dfe4423e326ba61441ae282a3db77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"_Excel3.xls","sha256":"ca247bbc612873ecdb089638a40b8c49c2df139cb7e30d0b6e54dab0033eed5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"_Excel4.xls","sha256":"61791894c1f957d44b2800201653b4672bbe16f770757fb192153789a323adab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"DW20.EXE","sha256":"6e86e7f6bc79791c1ffe92fa807de6505a79d3779d631b655c8c9804784aad6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dwtrig20.exe","sha256":"64d5dadcbf3c8d1b87c24f6dd5cefa92e8bae6f7eeb05d887bbd3a2d5ef344d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"fastfuzzer.lnk","sha256":"930d788c0e6e171d83e56094700994a7868284098d6550ddc698b60fe9297876","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Calculator.lnk","sha256":"c2aaf36761299ba2945d80f45d22173489f6e5718179fd09dd7e397d935a87bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"al.exe","sha256":"00090839abc40eb35f773508603b557161511da1a7beaa04a16ac7902099bca0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Adobe Reader XI.lnk","sha256":"0c064eeb2792665390e66f8618856a8f5777a9147d12a3dd2359b9846bb2467e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"FlashPlayerApp.exe","sha256":"2aa27e72bac31699a4c2d7cf65d003fa3474b3b5e87762301012f53a553e32dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Examples.lnk","sha256":"c685a56ddf4be472c6ca2cc37b8cf1e8ce8938e8f73280c6dfd329f70206c53c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Event Viewer.lnk","sha256":"6b704e7950aa5427b9b54f1e1ee297c7a1aa9f783b6147c92273d9038a52b50b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Desktop background.lnk","sha256":"18c294921047a632b2443795c075ebeabd271200f2ca2a0f902de5fce1a9d204","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"capinfos.exe","sha256":"46492b9f4d18410f75a1d06eb39965ffa2f550848202bb4a0c120ef784b84253","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dH1rDN9f9.doc","sha256":"bbd002918484bfe72f012fca41bf1a21028934373b399d6d0a4f67dc08530c4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Google Chrome.lnk","sha256":"544bd2713a9bee7fc3fc020db01c2091b348e97d4c32d7aacc271ea101fc5990","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"GoogleUpdateSetup.exe","sha256":"85dc834e9c536ea0c89dbaa8a41e5b9765c47de405ff8ad74017c6cc5dfb058c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dbh.exe","sha256":"74355e2681d1f0ca6d3987bedcb68f503ad039a15da0619e93afdf2a7040b43b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"cordbg.exe","sha256":"c41cbc35a0ab117c795c457170ae9cc811f76c1c50b1389c6b14db1131eff209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Command Prompt.lnk","sha256":"83d56544bc09256cb9d944e6bb29155d500edc2367eb47a2d0ad9a971d85d363","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"FlashPlayerUpdateService.exe","sha256":"2cbdfcab2a398313fd6fb2509e453cb0afd1aeb9965b0d3865ed41fbf249b692","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"6SZfLTu9z.doc","sha256":"8bf9b58f043d262c3b5eaf492c12e4a7c564f62d2568f79a6c84e357e4f547ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"aspnet_wp.exe","sha256":"cd3c25d93fa254ce79b0c2fc9290c8d02e5e27f245b02a0d54b064e1fb0328f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"ehExtHost.ni.exe","sha256":"f4ecc15413f22d720567dd0bfb02865101211a283b3f59a2027f72c48a30ff1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Help.lnk","sha256":"502fdfe81cf00957e6767781f3f6fc36517ddf878e51c35c4e86b770c3ae6b09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dumpchk.exe","sha256":"1d3a06e2cae767203c99bcb79ed943ab4941e08d4543f755cd6b7f4189d0c60d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"computer.lnk","sha256":"c99de16e81deb0719cf70675fc35b720766bc191759e2b135a3eb4d3500438aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"agestore.exe","sha256":"1d84bcb04af72ae68c41151ab63cad67c97784c0400d6bec79e1daee9cce40ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"C04T72pR0Bcl.doc","sha256":"ea7f755fc5a1a17ba430d2262d6a0e26c197e5877c8248215aec9fa37f5cfe1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"editbin.exe","sha256":"795c26b0e8c33dc7cc35e8b5b18883703a79223a139a1e01018a847494f967b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Desktop.lnk","sha256":"ad09b652fcafcd5cc80217a68ed82e02f03bad0226c9d76848070de39db3c6f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"firefox.exe","sha256":"8e4bb62a58f3af3d1fdc12f0e1c9671724d06d2d648443492c26b6bea5ea8538","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Create Recovery Disc.lnk","sha256":"62514fc6c73f61542c56c1c492447f360dfb42599144f1758e31577943166062","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"ComSvcConfig.ni.exe","sha256":"de712eb42c1931f4a040c99b6a0ac406081841e2cc7ab6c252148ec4707356bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dbengprx.exe","sha256":"350caa85b5d52435e68777a76955e4d8411398bb5efc897b9fe2ffaaa12df094","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"cl.exe","sha256":"6dc93131dc54f4eeb4a292481f1e96ece24ea7116c8baaeb9686f519fd0b8f39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Debugging Help.lnk","sha256":"feed6eeded94902dfb9b8bd34c32efa21762fc2c589f90ac3c8e5a722c31a738","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"GoogleUpdate.exe","sha256":"162810ccc03a93150cd38957b883a4e2d0ad9cb033fc5445f666281baabe7a93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"appverif.exe","sha256":"43a197d5805e23dca08247999da221f672a729065ab2328d03ab5440f6a6cd79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"fuzzer.lnk","sha256":"71874e08df9066992be41f8aa9a775ab0ee7ca1ac7d625fa185968cfa0392a32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"573b0c45b87472fe2c91e54dc094f7892a20f8fd1fc54126f915221dd2d833f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Character Map.lnk","sha256":"7ac683b4dbdef2012654f841055da30b8e5784825795037c69f8902f1a562c7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"EXCEL12.XLSX","sha256":"0814d3e54e991ee2eeb9bcca2e0a7ef3a98485adb2e2c3fd1f151a2f150bae72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AddInProcess32.exe","sha256":"c85c4cd24a9950d0b9a16b8f29d77b31c9bfad3d0d28b6790bdc13932b3e1143","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"GoogleUpdateComRegisterShell64.exe","sha256":"cc9043a84d081297758283c78b79401a961e23d50c9a2f1855a325f6b7db0191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"ComSvcConfig.exe","sha256":"d4a34d9872f92ed4f1646397abcdad4fed341b51961b4ad3298d33a602afdb44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"GoogleUpdateWebPlugin.exe","sha256":"63e63fda6576ebad1588cbb7fc7b1b2cf87ef63e05ec3f77cb9f3da77860c081","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"gflags.exe","sha256":"de31ccc4c56b9b868b80ecad3c4b32ffa2dcb74755a22ad27a1980c675e60788","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Fax recipient.lnk","sha256":"c74596570d2479b2d4df56f87347528f8430bf04e42ad295e40c7ac2acc3730e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Compile Script to .exe.lnk","sha256":"1edc58952c5b28b058cf5ecc4b7eaf5317d40d0f10e8efbc0e3feed506d30d2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"chkrzm.exe","sha256":"c3a09f38e52aafc8207d1fbb8d38f89174ef0c79f08cf9138661c4ca7d45c000","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"contosoroot.cer","sha256":"2d02c591223ef1535fa7405c3b144ddd09d101441d3cefd62a67a2d0fca7f171","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"DWTRIG20.EXE","sha256":"2f77531c9b7d1c1f26825e5b2399c8fb78a073d618bee0c5d25606db582202f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"contoso.cer","sha256":"3567ad413671edf8ad9ee5fbf0ed908b1b30af0770cd9747747a2c8fd993c3db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"batchmnt64.exe","sha256":"251c32d23efb4c61a669ef64dd55b76a0b1cdf6d7c45a103ca54b03e7b387a0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"checkv4.exe","sha256":"e5a3ba42c9f6df5951ce7f44492b4667dac41803ddf30ee547226bc318c89ada","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Fax Recipient.lnk","sha256":"19e068c9119edb9e44e350974a4fe425a9ecb6bda70a90cf890f2d7e7478cc88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dml.doc","sha256":"0e473b3d578b8cf6a0d9c6718a833e65f0e91046eabe58f7b4be8ef1f5c5fefa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dskCEJ.exe","sha256":"9b782ba069b6a4e824d09de399ce6138dfd021c4a2a3605ceb62e764e3a403f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"aspnet_merge.exe","sha256":"25a0bb82b54abe26ac25d27143ba0ce059e30759702dfd79c1331acaaffbf782","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Downloads.lnk","sha256":"29f6d399faf70fd753a469f3cc14d4ae16d23ba48599fa2ccb2653bc04899a76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"EQNEDT32.EXE","sha256":"1fd8662af4ee7cd971b64142a31d051d394c9b44708d9e4e1cd05b4160b68620","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dfsvc.ni.exe","sha256":"74e3b7a5fbf0e8129563a0bbbb450792fb392687f3ef7ef2579ef647b8e39188","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"betest.exe","sha256":"382528f4d0a3f304bac3723e6a3f9130fdff016129eb06b670a7b66e867073ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Action Center.lnk","sha256":"d9bd9ab603d4de9be39ad01ac857cc84721f559e28c91558a13c8c9300e02c3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"hlchPBL.exe","sha256":"62a6dc2442ea3b6ad0860e283f9c9eb2abf33b8fe62fd6de9fd2f410cb75daf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"bg3oTe.doc","sha256":"267fd201a0195a7ed729d02aced0dda24eefd6261713d0098e6ad16319e6f357","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"HeartsMCE.lnk","sha256":"bb87ce02cf7cb5656ee2ad946b655af5956d3a7b434fbc044f12e31dcba900c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"FreeCell.exe","sha256":"20ba01e045418d660e9bd6581aeafd8bf6398cb318b3137d24a91e88d643a6a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"DataSvcUtil.exe","sha256":"3e9f760c8afff88a7630d8f44597ea0ef38f05383b10fce41ea7f8ec66039b04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dbgrpc.exe","sha256":"d5120fb39f0dd161eacaf1cba54066d8cdef4c0694d2e70fc2abd05c63fbabe6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AdobeARM.exe","sha256":"61a532b953f521e990290054dccbeebd9ba564ead889cf381bc162d9baee382a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"FlashPlayerPlugin_24_0_0_221.exe","sha256":"1d8d996a0544dcf7b6662cdf5a8a89a62dd6b6b987bcd9ebc82af4df12c8f37f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AutoIt Window Info.lnk","sha256":"0f63f23b13017db9db31a6492bb77369cec57a23ada8a77c223a3a078308d5b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"cdb.exe","sha256":"65f5788f2b5d2748f2fefff0c93d8a9e157ab89f92915bcb6e0beb810f9c6a56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Ease of Access.lnk","sha256":"b9fa8795f93af4f603f80a99ef8a9b1171ea4b22dd2657415ab95cc266337f3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"csc.exe","sha256":"762f4bf0e87fc7b8dc0ae8bf221d4673490ad801ef27cc4968392f6050cc0ca5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"0zIG0D.doc","sha256":"06ce06ea585284696b531e7e5b6cecaf9ea07419fa376771ad70654d4b368e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"FUSLOGVW.exe","sha256":"b09a3ebb02b96121c01d0b35064f4ecb0d9fb58327a92d75e8eed7a4f4a92d99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Chess.lnk","sha256":"2734028a13de5ecbc8af528b156b5d09983708a5242df3791a93ca42571801aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"genmanifest.exe","sha256":"3e370695e10ac664838b51b12417a8f77be8b1d63bd55ce34a60eb376f1ffe47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"a3Ntx.exe","sha256":"5f92efcea745c13cee0e104048ed26ef2b59497169aed7607fedec15701a5b04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"GoogleUpdateOnDemand.exe","sha256":"793a61b17f71a6235dc9cc88ef20d1aefa7e9416fe962a30a4d4941188d16704","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Backup and Restore Center.lnk","sha256":"4a898258e4c1e8073b5e9da64af10be5a90c1fd2217477184a9e0e9108d70152","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"ecmangen.exe","sha256":"07b330e323c43ea2f237a70efa6aa7e757b240b7d37cbd004987748a1aa079aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"displayswitch.lnk","sha256":"d6a8c84b9c82fc20627fcb39eceb2e2b2f0365ace12b3eeae8c81dc1bba8720c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dumpexam.exe","sha256":"f54ff538bdecbc1894ce2c17f2c9976f2ba992b0d60176baf8fa33ddb5794e55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"batchmnt.exe","sha256":"966b7c97b43fbda26f773c15580962bcc5aa0b259d7f069314affb776c608979","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"chrome.exe","sha256":"6b92aad786882ecfe81e09af8cee72549a83a90b8e4f118986b80e6be2afb0bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"editcap.exe","sha256":"1a39bb947b631b1a6e709c4246964a83a88aa48f769c945eb78c705830530784","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"CNFNOT32.EXE","sha256":"d0004f0a6683b400672aec1affa75ed9330b0cad87962f4a9e8d818b826dc348","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dfsvc.exe","sha256":"5ced9ab94cca69ec3212d9b9a9c6acf0c134843ae7db6b366072fffe696b4a0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Global Flags.lnk","sha256":"2d907fff927649bcefe0b98988ea4cbcb17b98722ab51071c336e3c5647a53b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"bvYkKJ33N9A.exe","sha256":"71c7b3d9575f2c2883fb2b0ac83889185fc82fb081a369b731689776ad51b47e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Display.lnk","sha256":"358c839d2fd9f48b80c9638c5364a48bca677c7922f80433b671c87173d125a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"F3hzum1.doc","sha256":"88d46260a5617d5faefa41fcbbc6c60b3ef60252fa1686b44da9352b704962bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AccEvent.exe","sha256":"9baa10bd94e6a54aa36b1852aaf0a622ca26b854a2cf1e6cbff51759dc17a60b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"FileTypeVerifier.exe","sha256":"5a9b2fd95ef91ddc6bb4562bed745df171d0e13d8560582cf11639e01308b449","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"hKY8.doc","sha256":"60a3be705a2bd591caa80f96c26ab717edd1646e4655e3bdd0f284de000a646c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"0eee97adca0bde37a9f74967ece90ecd0a22f3d75926e71169a6d639bb96001c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"CorFlags.exe","sha256":"4d80680d1eb1d974faa8a769b4a35ca5fdc269256a5628de04ccf7a23fc7306f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AddInUtil.exe","sha256":"ece33fa0136a11c73e4e90485fa0f7119833b37901fb8010479aeab76b72f78e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Disk Cleanup.lnk","sha256":"a37c08ce58f3e349cd3ed3ba147e7ba6803c23924fc95df7ad641e34004d24f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AutoIt Help File.lnk","sha256":"04b7b033e8f69c1120c704ae446d655f05a82868856b685dbfadca97401f3c75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"ctrpp.exe","sha256":"3a42ceb6bf58d6c254935c760d56f143ed81461ccd0a80b71f4372a365fb6fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"GameExplorer.lnk","sha256":"a9aa2e22eb613fa55ef9ac7fe9a090b49375e07a12f199db2668488c0fad8653","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"armsvc.exe","sha256":"1456c9782a119e71de41b69008335c78b2d410e0207604b47764e2a2f3fc158e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"6839c2f218114629edc640fc7a4c1846226e8afc61356e97a309da623b49d900","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"ExtidGen.Exe","sha256":"59e9b98101abcb24676893d70644a3f3cb5ed7325aa4580f2bebcb144ed0e34a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"EKeaJO.doc","sha256":"946e61196c3aa463e7cc1a02aa926a9253d1ae6f82d2a3f528c65fb4785af254","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Bind.Exe","sha256":"f306c98be4031a2a32f7e33ee1f82d1d11d7aa982d72c2579e600f520dd5c8c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AdobeARMHelper.exe","sha256":"4cd937fdc8bb24a0ce7ae256d72b6e5b028d20ac3b3022ce06f7874cd11fce08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Control Panel.lnk","sha256":"29bf1dede09ac58a5b1e524467ffed4b122f9408b85a98905027448fc1e4ffe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"disco.exe","sha256":"96ccef63d2603a5970ec401db831a542af36b774371bc07a47c35cbf8e774aeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"0359845550748d92dcec1922f134f6d2381a1eab876c67f894ee6e8688255631","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"helper.exe","sha256":"d9eb1fa7fd3495788f1b604a42bacdec74111be275a0a162571d7d305d30ef2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"GoogleUpdateCore.exe","sha256":"151f47dfde65099842f90744cfded96a61deb75d049b8f1cd4edfc4586b57675","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"FreeCellMCE.lnk","sha256":"1ae1888893f72f6dde6651a08381e0b4b78eafef8cb2afc8ad36b1dc406ad589","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Check For Updates.lnk","sha256":"b6e11b84051ba8cd322dc75dffb048737de9eed74ea5f851482ddebeff44e841","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"ChessMCE.lnk","sha256":"9e2e9108e8f18c49927b03dd70785b826d7132500a5094556bc4eb498c24a46b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"aspnet_compiler.exe","sha256":"51760b6da3b0f4ca0f15d557df89b1f6d016c2028562ff0fa0be84df6dd7a46c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"EdmGen.exe","sha256":"40ce9edd1ed64edba7b85ea8c70738450e082d4c075abbe766166710c2ce4ccb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"FreeCell.lnk","sha256":"248f5a5c9f598068c3917f2967660a9dca47b2a040bbce311c0412e2a783f62d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dgQJde60mPXhI.exe","sha256":"7b2347c649264ecaf1811aeb6136a38b0f3d63a04f293fa20fec647c6315c9f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"FLTLDR.EXE","sha256":"39eb3d034c633c04ae45b2c54ba33c496f460b660165f1ba12b996afeba304c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Computer Management.lnk","sha256":"0c56be2f3540cb91c183033c2584fcada79ad85b996602b3d8b459f4be08750c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"chrmstp.exe","sha256":"37797deb5840caea3e39fcaad301fb0812ae78cdbcd9e18fa88d25ab478baa2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"dfrgui.lnk","sha256":"152ef4a50e1a88f371eaaa9be7656948b03dd8207e4706b6fbc0f6ada16f8ed6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"CertMgr.Exe","sha256":"9ebaac14e56e228cba83a885d473962684002fb18447452d72a810968f2762f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"CLVIEW.EXE","sha256":"05c2b269e59e905cda7b4f613a21046bd510bdd4527ce9c006b85cfbf81e917f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"aspnet_regsql.exe","sha256":"5ba09ab1981e3ec424b4ad8e2debd280ca20c0ede8a276c8fd5ec768cabad2ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"FiltReg.exe","sha256":"fc0825e793039ab48521b3ec006d461854271e2d916be49bd1eda750b0591293","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"gc.exe","sha256":"504dea31008a117f5d49c29d1e47439e1c8d6e49a1c3516986f1fefd9b695d79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"breakin.exe","sha256":"9076f8f2c03db83b18c7fac745781b8711825f2784320924af3ac954cb2c9e21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"guidgen.exe","sha256":"e8ac9171ed845f72bf138730b37cb976867f29eda54b00a1b47001bb65b3a79f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"0ee3aa6234c5247d98e6b793adefbed576cb7ab08e4d23cf942dce8a1704590e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"graphedt.exe","sha256":"4b63da880407e996e3a9546dd0f4672543dca4d0fa17fcc452c6d0382dc2ab5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"cvtres.exe","sha256":"4977958c91ab7065fb55306c843f7e7f0db7a0b9cee688ae6ea72d1e216a7640","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"AppLaunch.exe","sha256":"ba6d95c6193bd8fec2067c955191c5a4ee6d8d659abecb3ba656dc2c38e66b6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1.exe.config","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\marlett.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\batang.ttc","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cour.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\couri.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\courbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\courbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\daunpenh.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\dokchamp.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\estre.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\euphemia.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\gautami.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\gautamib.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\Vani.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\Vanib.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\gulim.ttc","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\impact.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\iskpota.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\iskpotab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\kalinga.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\kalingab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\kartika.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\kartikab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\KhmerUI.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\KhmerUIb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\LaoUI.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\LaoUIb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\latha.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\lathab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\lucon.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\malgunbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\mangal.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\mangalb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\meiryo.ttc","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\meiryob.ttc","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\himalaya.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\msjhbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\msyhbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\mingliu.ttc","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\mingliub.ttc","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\monbaiti.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\msgothic.ttc","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\msmincho.ttc","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\mvboli.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ntailu.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ntailub.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\nyala.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\phagspa.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\phagspab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\plantc.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\raavi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\raavib.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\segoesc.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\segoescb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\shruti.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\shrutib.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\simsun.ttc","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\simsunb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\sylfaen.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\taile.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\taileb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\tunga.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\tungab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\vrinda.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\vrindab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\Shonar.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\Shonarb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\msyi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\tahomabd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\angsa.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\angsai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\angsab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\angsaz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\aparaj.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\aparajb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\aparajbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\aparaji.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cordia.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cordiai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cordiab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cordiaz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ebrima.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ebrimabd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\gisha.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\gishabd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\kokila.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\kokilab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\kokilabi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\kokilai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\leelawad.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\leelawdb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\msuighur.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\moolbor.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\symbol.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\utsaah.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\utsaahb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\utsaahbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\utsaahi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\vijaya.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\vijayab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\wingding.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\modern.fon","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\roman.fon","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\script.fon","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\andlso.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\arabtype.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\simpo.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\simpbdo.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\simpfxo.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\majalla.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\majallab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\trado.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\tradbdo.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ahronbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\david.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\davidbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\frank.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\lvnm.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\lvnmbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\mriam.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\mriamc.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\nrkis.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\rod.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\simfang.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\simhei.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\simkai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\angsau.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\angsaui.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\angsaub.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\angsauz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\browa.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\browai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\browab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\browaz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\browau.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\browaui.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\browaub.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\browauz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cordiau.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cordiaub.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cordiauz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cordiaui.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcdl.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcdi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcdb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcdbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcel.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcei.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upceb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcebi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcfl.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcfi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcfb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcfbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcil.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcii.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcib.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcibi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcjl.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcji.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcjb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcjbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upckl.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcki.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upckb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upckbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcll.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upcli.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upclb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\upclbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\kaiu.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\l_10646.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\calibri.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\calibrii.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\calibrib.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\calibriz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cambria.ttc","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cambriai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cambriab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\cambriaz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\Candara.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\Candarai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\Candarab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\Candaraz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\comic.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\comicbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\consola.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\consolai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\consolab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\consolaz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\constan.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\constani.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\constanb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\constanz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\corbel.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\corbeli.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\corbelb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\corbelz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\framd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\framdit.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\Gabriola.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\georgia.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\georgiai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\georgiab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\georgiaz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\pala.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\palai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\palab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\palabi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\segoepr.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\segoeprb.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\trebuc.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\trebucit.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\trebucbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\trebucbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\verdana.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\verdanai.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\verdanab.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\verdanaz.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\webdings.ttf","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\coure.fon","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\serife.fon","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\sserife.fon","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\smalle.fon","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\smallf.fon","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%TEMP%\\vchost.exe","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%TEMP%\\43n4D0OiE53Z35X.exe","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1.exe","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Esl\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm\\PMP\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Multimedia\\MPP\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins3d\\prc\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Tracker\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\SaslPrep\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\ICU\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\Application Verifier\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Aut2Exe\\Icons\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\AutoItX\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\C++\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoItX\\Examples\\VBScript\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\COM\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Advanced\\Images\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\GUI\\Simple\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\Examples\\Helpfile\\Extras\\HOW TO DECRYPT FILES.txt","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\.BOOM\\","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\QYIWIAFZZRVTQUB\\","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\QYIWIAFZZRVTQUB\\DEFAULTICON\\","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\QYIWIAFZZRVTQUB\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\QYIWIAFZZRVTQUB\\SHELL\\","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\QYIWIAFZZRVTQUB\\SHELL\\OPEN\\","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c34a5307ca3e1506b7a1be3"}]}]}},"report_ids":{"sandbox_job_ids":["5c34a5307ca3e1506b7a1be3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample c478913dd84c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c478913dd84c…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample c478913dd84c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c478913dd84c…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c478913dd84ce396f66cefa88e23588100aab951ff1b01aac9ea72fac12611b1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample c478913dd84c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c478913dd84c…. Malware family: Trojan.Generic. Threat score 100/100. 20/29 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]