24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.NetSky Sample c8fffb2e7375… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c8fffb2e7375…. Malware family: Worm.NetSky. Threat score 100/100. 26/27 AV engines flagged this file. 14 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","keywords":["Malicious","Worm.NetSky","malware analysis","sandbox report","threat intelligence","c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525"],"about":{"@type":"SoftwareApplication","name":"document.doc .exe","applicationCategory":["peexe","executable"],"identifier":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.NetSky","antivirusDetections":{"malicious":26,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9e6,"outlook.bak.exe" wrote bytes "80b96e7570c96e7500cb6e7520bb6e75" to virtual address "0x76F3E170" (part of module "KERNELBASE.DLL") "outlook.bak.exe" wrote bytes "0070725d" to virtual address "0x74A54EEC" (part of module "USER32.DLL") "outlook.bak.exe" wrote bytes "d07e6e75f0827075a0396d75000e6e75607b6e7550c76d755086707560817075d0066e7560806e7550c06d7520296d75f0106e7550336d7570326d75103e6d75802a6d7550cf7075c0396d7570396d75d0396d7590826e75a07b6e75" to virtual address "0x76F3E238" (part of module "KERNELBASE.DLL") "outlook.bak.exe" wrote bytes "1032f97680ecfd76208afa7600000000" to virtual address "0x740C3000" (part of module "WIN32U.DLL") "outlook.bak.exe" wrote bytes "e99bad80fc" to virtual address "0x749DF850" ("GetAsyncKeyState@USER32.DLL") "outlook.bak.exe" wrote bytes "e93bfd80fc" to virtual address "0x749DAD50" ("GetWindowTextA@USER32.DLL") "outlook.bak.exe" wrote bytes "e98bbe7ffc" to virtual address "0x749EE990" ("GetForegroundWindow@USER32.DLL") "outlook.bak.exe" wrote bytes "e9bbda6dfd" to virtual address "0x73AF3F20" ("CredEnumerateW@ADVAPI32.DLL") "outlook.bak.exe" wrote bytes "0070725d" to virtual address "0x77089218" ("Wow64Transition@NTDLL.DLL") "outlook.bak.exe" wrote bytes "0070725d" to virtual address "0x76F38AA0" (part of module "KERNELBASE.DLL") "outlook.bak.exe" wrote bytes "20906e7550946e7540926e7520916e7500956e75009b6e75b0936e75809a6e75" to virtual address "0x76F3E1A4" (part of module "KERNELBASE.DLL") "outlook.bak.exe" wrote bytes "b60dbe65" to virtual address "0x7708B350" (part of module "NTDLL.DLL") "outlook.bak.exe" wrote bytes "0070725d" to virtual address "0x740C3010" (part of module "WIN32U.DLL") "outlook.bak.exe" wrote bytes "e94b7380fc" to virtual address "0x749E3700" ("GetActiveWindow@USER32.DLL") "outlook.bak.exe" wrote bytes "e92b066efd" to virtual address "0x73AF0B30" ("AdjustTokenPrivileges@ADVAPI32.DLL") "outlook.bak.exe" wrote bytes "e97b1f6cfd" to virtual address "0x73B14FD0" ("LookupAccountSidA@ADVAPI32.DLL") "outlook.bak.exe" wrote bytes "d04c7075d0156d75a0766d7540186d75" to virtual address "0x76F3E190" (part of module "KERNELBASE.DLL") "outlook.bak.exe" wrote bytes "e99bdb7afc" to virtual address "0x74A3CCC0" ("ExitWindowsEx@USER32.DLL") "outlook.bak.exe" wrote bytes "f0767175e077717540767175f07571753078717510156e75b05e7175807871759077717590767175605e717540777175" to virtual address "0x76F3E1D4" (part of module "KERNELBASE.DLL") "outlook.bak.exe" wrote bytes "0070725d" to virtual address "0x75731E98" (part of module "KERNEL32.DLL")26:T697,Heuristic match: "126.com" Heuristic match: "126mx02.mxmail.netease.com" Heuristic match: "aaw.pl" Heuristic match: "adatum.com" Heuristic match: "animo.br" Heuristic match: "aol.com" Heuristic match: "aspmx2.googlemail.com" Heuristic match: "contoso-com.mail.protection.outlook.com" Heuristic match: "contoso.com" Heuristic match: "contoso.com.br" Heuristic match: "contoso.com.pt" Heuristic match: "contoso.es" Heuristic match: "contoso.mx" Heuristic match: "example.com" Heuristic match: "example.es" Heuristic match: "example.mx" Heuristic match: "fabrikam.com" Heuristic match: "fafa.pk" Heuristic match: "gmail.com" Heuristic match: "griepp.pl" Heuristic match: "hotmail-com.olc.protection.outlook.com" Heuristic match: "hotmail.com" Heuristic match: "kywx.com.pt" Heuristic match: "mail.adatum.com" Heuristic match: "mail.fabrikam.com" Heuristic match: "mail.h-email.net" Heuristic match: "mail.ru" Heuristic match: "mail.sexnet.com" Heuristic match: "msn-com.olc.protection.outlook.com" Heuristic match: "mta6.am0.yahoodns.net" Heuristic match: "musical.com.br" Heuristic match: "mx-aol.mail.gm0.yahoodns.net" Heuristic match: "mx247.in-mx.com" Heuristic match: "mxin.vub.ac.be" Heuristic match: "mxs.mail.ru" Heuristic match: "oopp.pl" Heuristic match: "pirajui.br" Heuristic match: "proseware.com" Heuristic match: "quatro.br" Heuristic match: "riekk.pl" Heuristic match: "sexnet.com" Heuristic match: "vade-in2.mail.dreamhost.com" Heuristic match: "vub.ac.be" Heuristic match: "wewew.pl" Heuristic match: "x.com.pt" Heuristic match: "xara.pl" Heuristic match: "xyz.com" Heuristic match: "xyz.com.br" Heuristic match: "yahoo.com"27:T15db,67/72 Antivirus vendors marked dropped file "FVProtect.exe.bin" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Microsoft WinXP Crack full.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Harry Potter game.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "DivX 8.0 final.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "MS Service Pack 6.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Doom 3 release 2.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Arnold Schwarzenegger.jpg.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Eminem Song text archive.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Ahead Nero 8.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Britney Spears fuck.jpg.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Harry Potter.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Britney Spears Song text archive.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Eminem Spears porn.jpg.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Cracks _ Warez Archiv.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Teen Porn 15.jpg.pif" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Learn Programming 2004.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "How to hack new.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Visual Studio Net Crack all.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Eminem full album.mp3.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Adobe Premiere 10.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "1001 Sex and more.rtf.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Kazaa Lite 4.0 new.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Opera 11.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Microsoft Office 2003 Crack best.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Britney Spears and Eminem porn.jpg.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Britney Spears cumshot.jpg.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Win Longhorn re.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "WinXP eBook newest.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Britney Spears Sexy archive.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Britney Spears.mp3.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "RFC compilation.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "ACDSee 10.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Windows 2000 Sourcecode.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Internet Explorer 9 setup.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Britney Spears porn.jpg.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Eminem Sexy archive.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Kazaa new.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Dictionary English 2004 - France.doc.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Harry Potter 5.mpg.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate) 67/72 Antivirus vendors marked dropped file "Clone DVD 6.exe" as malicious (classified as "Netsky.P@mm" with 93% detection rate)28:T4aa,"Mail traffic to 94.100.180.104 on port 25 (SMTP), "Mail traffic to 45.55.52.96 on port 25 (SMTP) "Mail traffic to 220.181.15.151 on port 25 (SMTP), "Mail traffic to 67.195.228.106 on port 25 (SMTP) "Mail traffic to 104.47.48.33 on port 25 (SMTP), "Mail traffic to 142.250.102.26 on port 25 (SMTP) "Mail traffic to 134.184.129.114 on port 25 (SMTP), "Mail traffic to 104.47.17.97 on port 25 (SMTP) "Mail traffic to 98.136.96.93 on port 25 (SMTP), "Mail traffic to 204.6.193.5 on port 25 (SMTP) "Mail traffic to 172.217.222.27 on port 25 (SMTP), "Mail traffic to 66.33.205.213 on port 25 (SMTP) "Mail traffic to 94.152.34.135 on port 25 (SMTP), "Mail traffic to 104.47.38.36 on port 25 (SMTP) "Mail traffic to 131.107.88.24 on port 25 (SMTP), "Mail traffic to 64.233.186.27 on port 25 (SMTP) "Mail traffic to 18.237.235.220 on port 25 (SMTP), "Mail traffic to 131.107.55.31 on port 25 (SMTP) "Mail traffic to 94.100.180.31 on port 25 (SMTP), "Mail traffic to 98.136.96.76 on port 25 (SMTP) "Mail traffic to 104.47.5.33 on port 25 (SMTP), "Mail traffic to 104.47.17.161 on port 25 (SMTP) "Mail traffic to 67.195.204.75 on port 25 (SMTP), "Mail traffic to 104.47.10.33 on port 25 (SMTP)29:T4ac,Found malicious artifacts related to "192.254.190.168": ... URL: http://bathroomtilesdesigns.com/support/conf/Thanks.php (AV positives: 6/71 scanned on 11/25/2019 00:31:47) URL: http://bathroomtilesdesigns.com/support/conf/first.php (AV positives: 6/71 scanned on 11/02/2019 19:52:28) URL: http://bathroomtilesdesigns.com/ (AV positives: 1/71 scanned on 08/13/2019 18:59:55) URL: http://192.254.190.168/ (AV positives: 1/71 scanned on 08/06/2019 12:38:59) URL: http://petraegypt.com/ (AV positives: 2/71 scanned on 07/25/2019 13:00:18) File SHA256: 0ff0b7fcb090c65d0bdcb2af4bbd2c30f33356b3ce9b117186fa20391ef840a3 (AV positives: 4/73 scanned on 10/26/2019 10:05:51) File SHA256: 6a67d85a3740ab6e955afd67cc06d70b48e8b94551b689434b79262256c2843a (AV positives: 1/53 scanned on 11/28/2016 12:58:08) File SHA256: 4bb7b20f6b85bb573a346ee0fc1fbdae31fed695300d085c9a414fdc95a5235f (AV positives: 3/56 scanned on 04/14/2016 07:04:18) File SHA256: 55775b05604dcdcb8ff796f32ecb70156217708869813504d8604ef05a0937b7 (AV positives: 1/54 scanned on 04/14/2016 03:52:55) File SHA256: f6c5606fabac3c822192bafa04ae103c0f3609c40961af758133208736795e10 (AV positives: 5/57 scanned on 04/13/2016 00:06:09)2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAdwAAAAAAAAAAAAAAAAAAAHeIiIiIiIiIiIiIgIAAAAB///////////////gIAAAAf///////+Ij//4iICAAAAH/0RERP/5mf//mZ+AgAAAB////////5j///mPgIAAAAf/RERERP/5iIiJj4CAAAAH/////////5mZmY+AgAAAB/9ERERERP/5j/mPgIAAAAf//////////5j5j4CAAAAH/0RERERERP/5iY+AgAAAB////////////5mPgIAAAAf/RERERERERP/5/4CAAAAH//////////////+AgAAAB/9ERERERERERET/gIAAAAf//////////////4CAAAAH/0RERERERERERP+AgAAAB///////////////gIAAAAf/AAAAAP9ERERE/4CAAAAH/3mQ//D///////+AgAAAB/9wAAAA/0RERET/gIAAAAf/f/C7sP///////4CAAAAH/3AAu7D/RERERP+AgAAAB/9/8Luw////////gIAAAAf/f/DMwP///////4CAAAAH/3/wzMD///////+AgAAAB/93cAAA////////gIAAAAf//////////////4CAAAAH8P8P8P8P8P8P8P9wgAAAB/D/D/D/D/D/D/D/cIAAAAAPd/d/d/d/d/d/d/cAAAAAAAAAAAAAAAAAAAAAAADgAAAP4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAf4AAAP/////w==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAdwAAAAAAAAAAAAAAAAAAAHeIiIiIiIiIiIiIgIAAAAB///////////////gIAAAAf///////+Ij//4iICAAAAH/0RERP/5mf//mZ+AgAAAB////////5j///mPgIAAAAf/RERERP/5iIiJj4CAAAAH/////////5mZmY+AgAAAB/9ERERERP/5j/mPgIAAAAf//////////5j5j4CAAAAH/0RERERERP/5iY+AgAAAB////////////5mPgIAAAAf/RERERERERP/5/4CAAAAH//////////////+AgAAAB/9ERERERERERET/gIAAAAf//////////////4CAAAAH/0RERERERERERP+AgAAAB///////////////gIAAAAf/AAAAAP9ERERE/4CAAAAH/3mQ//D///////+AgAAAB/9wAAAA/0RERET/gIAAAAf/f/C7sP///////4CAAAAH/3AAu7D/RERERP+AgAAAB/9/8Luw////////gIAAAAf/f/DMwP///////4CAAAAH/3/wzMD///////+AgAAAB/93cAAA////////gIAAAAf//////////////4CAAAAH8P8P8P8P8P8P8P9wgAAAB/D/D/D/D/D/D/D/cIAAAAAPd/d/d/d/d/d/d/cAAAAAAAAAAAAAAAAAAAAAAADgAAAP4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAf4AAAP/////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790338395435,"unified_at":"2026-09-25T12:13:15.435Z","metadata":{"hashes":{"sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","sha1":"7031cfe76ee7b2c925f2c00372fb9ef7f983f60c","md5":"3018e99857f31a59e0777396ae634a8f","sha512":"4604c98f765be26d4a0a33f54cc777810cae7fab5153ee637b4fc8057492fd40de6fdf9d88dc4f7f34f45dd174bae54a2b39e0f0e5f1f5997820b9bccf47686a","ssdeep":"768:vWkliAnUQYkYKzqbjC5RqHjrYReyZx+l0oKriCPRDL:+ySsz6jGeyZx+l0TR","ssdeep_chunks":["768:vWkliAn","768:WkliAnU","768:kliAnUQ","768:liAnUQY","768:iAnUQYk","768:AnUQYkY","768:nUQYkYK","768:UQYkYKz","768:QYkYKzq","768:YkYKzqb","768:kYKzqbj","768:YKzqbjC","768:KzqbjC5","768:zqbjC5R","768:qbjC5Rq","768:bjC5RqH","768:jC5RqHj","768:C5RqHjr","768:5RqHjrY","768:RqHjrYR","768:qHjrYRe","768:HjrYRey","768:jrYReyZ","768:rYReyZx","768:YReyZx+","768:ReyZx+l","768:eyZx+l0","768:yZx+l0o","768:Zx+l0oK","768:x+l0oKr","768:+l0oKri","768:l0oKriC","768:0oKriCP","768:oKriCPR","768:KriCPRD","768:riCPRDL","1536:vWkliAn","1536:WkliAnU","1536:kliAnUQ","1536:liAnUQY","1536:iAnUQYk","1536:AnUQYkY","1536:nUQYkYK","1536:UQYkYKz","1536:QYkYKzq","1536:YkYKzqb","1536:kYKzqbj","1536:YKzqbjC","1536:KzqbjC5","1536:zqbjC5R","1536:qbjC5Rq","1536:bjC5RqH","1536:jC5RqHj","1536:C5RqHjr","1536:5RqHjrY","1536:RqHjrYR","1536:qHjrYRe","1536:HjrYRey","1536:jrYReyZ","1536:rYReyZx","1536:YReyZx+","1536:ReyZx+l","1536:eyZx+l0","1536:yZx+l0o","1536:Zx+l0oK","1536:x+l0oKr","1536:+l0oKri","1536:l0oKriC","1536:0oKriCP","1536:oKriCPR","1536:KriCPRD","1536:riCPRDL","768:+ySsz6j","768:ySsz6jG","768:Ssz6jGe","768:sz6jGey","768:z6jGeyZ","768:6jGeyZx","768:jGeyZx+","768:GeyZx+l","768:yZx+l0T","768:Zx+l0TR"],"imphash":"87bed5a7cba00c7e1f4015f1bdae2183"},"file_info":{"file_name":"document.doc .exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":29568,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294456000,"last_seen":1691936876000,"last_multi_scan":1691936876000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["mydoom","worm"]},"stats":{"av":{"malicious_count":26,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":16},"sandbox_signatures":{"informative_count":22,"suspicious_count":21,"malicious_count":14,"total":57},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Worm.Win32.NetSky.l46a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Fsg.29568","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Worm[Email]/Win32.NetSky","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"WORM/Netsky.AP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Win32.Netsky.P@mm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Worm.NetSky-2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Netsky.Q","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Win32.Netsky.P@mm (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Netsky.Q worm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"EmailWorm ( 004c12241 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Email-Worm.Win32.NetSky.q","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W32/Netsky.i.p@MM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.NetSky.efhfsm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Net-Worm.Win32.NetSky","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W32/Netsky-P","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Worm/W32.NetSky.29568","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"WORM_NETSKY.P","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"WORM_NETSKY.P","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Netsky.P@mm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"I-WORM.Netsky.P","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Worm.NetSky.q","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.NetSky.Win32.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Worm.NetSky","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/techniques/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"malicious","value":"Sends network traffic on a typical mail related ports"}],"sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"t\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"outlook.bak.exe\" called \"RtlGetVersion\" with parameter __ (UID: 00000000-00002972)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"outlook.bak.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin)","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 43934-22-0040021F\n LoadLibraryA@KERNEL32.DLL at 00000000-00002972-46099-2-0041201F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has overlay in c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin","origin":"Static Parser","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin\" has an writable section named \"t\"\n \"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin\" has an writable section named \"ta\"\n \"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin\" has an writable section named \"a\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin\" file has an entrypoint instructions - \"movebx, 0x4001d0,movedi, 0x401000,movesi, 0x411c2c,pushebx,call0x41201f,adddl, dl,jne0x41201e,movdl, byte ptr [esi],incesi,adcdl, dl,ret,cld,movdl, 0x80,movsbbyte ptr es:[edi], byte ptr [esi],push2,popebx,calldword ptr [esp],jae0x412022,xorecx, ecx,calldword ptr [esp],jae0x41204a,xoreax, eax,calldword ptr [esp],jae0x41205a,movbl, 2,incecx,moval, 0x10,calldword ptr [esp],adcal, al,jae0x41203e,jne0x412086,stosbbyte ptr es:[edi], al,jmp0x412026,call0x412092,subecx, ebx,jne0x412063,call0x412090,jmp0x412082,lodsbal, byte ptr [esi],shreax, 1,je0x4120a0,adcecx, ecx,jmp0x41207f,xchgeax, ecx,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"\"outlook.bak.exe\" trying to access non-existent file \"%WINDIR%\\System32\\WOW64LOG.DLL\"\n \"outlook.bak.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"outlook.bak.exe\" trying to access non-existent file \"%WINDIR%\\SysWOW64\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"outlook.bak.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002972)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin\" was detected as \"FSG v1.00 (Eng) -> dulek/xt\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"outlook.bak.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"outlook.bak.exe\" queried SystemProcessInformation at 00000000-00002972-00000036-867004\n \"outlook.bak.exe\" queried SystemProcessInformation at 00000000-00002972-00000036-868379","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"ta with unusual entropies 7.96549196097","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"29/35 Antivirus vendors marked sample as malicious (82% detection rate)\n 64/71 Antivirus vendors marked sample as malicious (90% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin\" has resource with unusual entropy \"BINARY:7.99281753609\"\n \"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin\" has resource with unusual entropy \"RT_ICON:7.26630544683\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"outlook.bak.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 1567769856)\n \"outlook.bak.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1567769857)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetAsyncKeyState@USER32.DLL\" in \"outlook.bak.exe\"\n \"GetWindowTextA@USER32.DLL\" in \"outlook.bak.exe\"\n \"GetForegroundWindow@USER32.DLL\" in \"outlook.bak.exe\"\n \"CredEnumerateW@ADVAPI32.DLL\" in \"outlook.bak.exe\"\n \"Wow64Transition@NTDLL.DLL\" in \"outlook.bak.exe\"\n \"GetActiveWindow@USER32.DLL\" in \"outlook.bak.exe\"\n \"AdjustTokenPrivileges@ADVAPI32.DLL\" in \"outlook.bak.exe\"\n \"LookupAccountSidA@ADVAPI32.DLL\" in \"outlook.bak.exe\"\n \"ExitWindowsEx@USER32.DLL\" in \"outlook.bak.exe\"\n \"GetKeyState@USER32.DLL\" in \"outlook.bak.exe\"\n \"GetWindowTextW@USER32.DLL\" in \"outlook.bak.exe\"\n \"CredEnumerateA@ADVAPI32.DLL\" in \"outlook.bak.exe\"\n \"EnumWindows@USER32.DLL\" in \"outlook.bak.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin\" has an entrypoint in section \"a\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"29/35 Antivirus vendors marked sample as malicious (82% detection rate)\n 64/71 Antivirus vendors marked sample as malicious (90% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\'D'r'o'p'p'e'd'S'k'y'N'e't'\"\n \"\\Sessions\\1\\BaseNamedObjects\\_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"userconfig9x.dll.1502539336\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"\n \"base64.tmp.2609233044\" has type \"ASCII text, with CRLF line terminators\"\n \"FVProtect.exe.2871630962\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%WINDIR%\\userconfig9x.dll\"\n \"\" created file \"%WINDIR%\\FVProtect.exe\"\n \"\" created file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%WINDIR%\\base64.tmp\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"userconfig9x.dll.1502539336\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"\n \"FVProtect.exe.2871630962\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"NORTON ANTIVIRUS AV\", Value: \"%WINDIR%\\FVProtect.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"49/54 Antivirus vendors marked dropped file \"userconfig9x.dll.1502539336\" as malicious (classified as \"Netsky.P@mm\" with 90% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 26624 bytes starting with PE header signature to file \"%WINDIR%\\userconfig9x.dll\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...\n \"\" wrote 29568 bytes starting with PE header signature to file \"%WINDIR%\\FVProtect.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"126.com\"\n \"126mx02.mxmail.netease.com\"\n \"\"\n \"aaw.pl\"\n \"adatum.com\"\n \"animo.br\"\n \"aol.com\"\n \"aspmx2.googlemail.com\"\n \"contoso-com.mail.protection.outlook.com\"\n \"contoso.com\"\n \"contoso.com.br\"\n \"contoso.com.pt\"\n \"contoso.es\"\n \"contoso.mx\"\n \"example.com\"\n \"example.es\"\n \"example.mx\"\n \"fabrikam.com\"\n \"fafa.pk\"\n \"fajrant.qz\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"94.100.180.104:25\"\n \"45.55.52.96:25\"\n \"220.181.15.151:25\"\n \"67.195.228.106:25\"\n \"104.47.48.33:25\"\n \"142.250.102.26:25\"\n \"134.184.129.114:25\"\n \"104.47.17.97:25\"\n \"98.136.96.93:25\"\n \"204.6.193.5:25\"\n \"172.217.222.27:25\"\n \"66.33.205.213:25\"\n \"94.152.34.135:25\"\n \"104.47.38.36:25\"\n \"131.107.88.24:25\"\n \"64.233.186.27:25\"\n \"18.237.235.220:25\"\n \"131.107.55.31:25\"\n \"94.100.180.31:25\"\n \"98.136.96.76:25\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"document.txt.exe\" touched \"WebCheck\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\\INPROCSERVER32\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"FVProtect.exe\" (UID: 00088647-00002364) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", PROMPT=\"$P$G\"\"\n Process \"FVProtect.exe\" (UID: 00088647-00002364) was launched with modified environment variables: \"CommonProgramFiles, Path, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"document.txt.exe\" touched file \"%WINDIR%\\zipped.tmp\"\n \"document.txt.exe\" touched file \"%WINDIR%\\zip3.tmp\"\n \"document.txt.exe\" touched file \"%WINDIR%\\userconfig9x.dll\"\n \"document.txt.exe\" touched file \"%WINDIR%\\FVProtect.exe\"\n \"document.txt.exe\" touched file \"%WINDIR%\\FVProtect.exe:Zone.Identifier\"\n \"document.txt.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"document.txt.exe\" touched file \"%WINDIR%\\base64.tmp\"\n \"document.txt.exe\" touched file \"%WINDIR%\\zip1.tmp\"\n \"document.txt.exe\" touched file \"%WINDIR%\\zip2.tmp\"\n \"document.txt.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \"document.txt.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \"FVProtect.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"FVProtect.exe\" touched file \"%WINDIR%\\FVProtect.exe\"\n \"FVProtect.exe\" touched file \"%WINDIR%\\base64.tmp\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"document.txt.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"FVProtect.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"document.txt.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"FVProtect.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"document.txt.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"FVProtect.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"3/79 reputation engines marked \"http://adatum.com\" as malicious (3% detection rate)\n 1/80 reputation engines marked \"http://animo.br\" as malicious (1% detection rate)\n 1/80 reputation engines marked \"http://aaw.pl\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"kywx.com.pt\" seems to be random\n \"lufka.zx\" seems to be random\n \"musical.com.br\" seems to be random\n \"mxin.vub.ac.be\" seems to be random\n \"mxs.mail.ru\" seems to be random\n \"xxv.pq\" seems to be random\n \"xyz.com.br\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Network Related","name":"Detected very many DNS queries for domains that cannot be resolved","description":"\"126.com\"\n \"\"\n \"aaw.pl\"\n \"adatum.com\"\n \"animo.br\"\n \"aol.com\"\n \"contoso.com\"\n \"contoso.com.br\"\n \"contoso.com.pt\"\n \"contoso.es\"\n \"contoso.mx\"\n \"example.com\"\n \"example.es\"\n \"example.mx\"\n \"fabrikam.com\"\n \"fafa.pk\"\n \"fajrant.qz\"\n \"fanfary.pq\"\n \"gmail.com\"\n \"griepp.pl\"\n \"hotmail.com\"\n \"kywx.com.pt\"\n \"lufka.zx\"\n \"mail.ru\"\n \"musical.com.br\"\n \"oopp.pl\"\n \"pirajui.br\"\n \"proseware.com\"\n \"quatro.br\"\n \"riekk.pl\"","origin":"Network Traffic","relevance":10,"id":"network-34","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1157 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"document.txt.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"FVProtect.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"document.txt.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"document.txt.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"document.txt.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"FVProtect.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"FVProtect.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"FVProtect.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"document.txt.exe\" created file \"%WINDIR%\\FVProtect.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ETPRO MALWARE Worm.Win32/Netsky.P@mm spreading via SMTP 2\" (SID: 2806860, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)\n Detected alert \"ETPRO MALWARE Worm.Win32/Netsky.P@mm spreading via SMTP 1\" (SID: 2806859, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)\n Detected alert \"ETPRO MALWARE Worm.Mydoom spreading via SMTP 30\" (SID: 2810646, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)\n Detected alert \"ETPRO MALWARE High Volume Outbound SMTP - Repeated Space .exe Filename\" (SID: 2842992, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)\n Detected alert \"ETPRO MALWARE Worm.Mydoom spreading via SMTP 27\" (SID: 2810643, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$27","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"malicious","category":"Installation/Persistance","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\FVProtect.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 24 (or more) hosts in at least 5 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"level":"malicious","category":"Network Related","name":"Detected many DNS responses with a low TTL","description":"\"126mx02.mxmail.netease.com\" with TTL 417\n \"aspmx2.googlemail.com\" with TTL 292\n \"contoso-com.mail.protection.outlook.com\" with TTL 9\n \"contoso.com.pt\" with TTL 299\n \"hotmail-com.olc.protection.outlook.com\" with TTL 9\n \"kywx.com.pt\" with TTL 299\n \"mail.h-email.net\" with TTL 148\n \"mail.ru\" with TTL 308\n \"msn-com.olc.protection.outlook.com\" with TTL 19\n \"mta6.am0.yahoodns.net\" with TTL 23\n \"mx-aol.mail.gm0.yahoodns.net\" with TTL 12\n \"mx247.in-mx.com\" with TTL 371\n \"mxs.mail.ru\" with TTL 39\n \"proseware.com\" with TTL 299\n \"vade-in2.mail.dreamhost.com\" with TTL 293\n \"x.com.pt\" with TTL 299","origin":"Network Traffic","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a typical mail related ports","description":"$28","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":6,"id":"network-10","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"document.txt.exe\" checked file \"C:\"\n \"FVProtect.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"63e3b7ee583d7128542128e7"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 54 domains and 54 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":70,"dropped_files_count":0,"extracted_files_count":86,"files_written_count":225,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":41,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":44,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":45,"dns_resolutions_count":80,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["mydoom","worm"],"sample_flags":["Extracted Files","Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"63e3b7ee583d7128542128e7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Netsky.P@mm","submit_name":"outlook.bak","analysis_start_time":"2023-02-08T15:10:33+00:00","indicators_count":{"informative":13,"suspicious":12,"malicious":3},"is_in_unified_schema":true},{"id":"5f1e1c89e098e2768163a18f","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Netsky.P@mm","contacted_countries":["BEL","CAN","CHN","ESP","EU","GBR","POL","RUS","USA"],"submit_name":"document.txt .exe","analysis_start_time":"2020-07-27T00:15:12+00:00","indicators_count":{"informative":11,"suspicious":20,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5730bd90aac2ed6e5a6de021","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Worm.Netsky","contacted_countries":["BEL","CAN","CHN","DEU","EU","GBR","POL","RUS","SGP","USA"],"submit_name":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","analysis_start_time":"2019-11-26T12:22:38+00:00","indicators_count":{"informative":10,"suspicious":20,"malicious":11},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"56d05725aac2ed8f777b23c8","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.3160","submit_name":"message.scr","analysis_start_time":"2016-02-26T07:46:27+00:00","indicators_count":{"informative":2,"suspicious":11,"malicious":6},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"55785b828690b87039d34597","environment_id":1,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.3160","submit_name":"document.doc .exe","analysis_start_time":"2015-06-10T17:46:14+00:00","indicators_count":{"informative":0,"suspicious":4,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"94.100.180.104","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"45.55.52.96","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"220.181.15.151","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"67.195.228.106","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"104.47.48.33","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"142.250.102.26","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"134.184.129.114","port":25,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"104.47.17.97","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"98.136.96.93","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"204.6.193.5","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"172.217.222.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"66.33.205.213","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"94.152.34.135","port":25,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"104.47.38.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"131.107.88.24","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"64.233.186.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"18.237.235.220","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"131.107.55.31","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"94.100.180.31","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"98.136.96.76","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"104.47.5.33","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"104.47.17.161","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"address":"67.195.204.75","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"104.47.10.33","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"220.181.15.194","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"67.195.204.72","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"104.47.8.33","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"64.233.177.26","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"104.47.46.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"104.47.44.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"17.171.2.68","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"104.47.5.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"173.228.157.39","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"207.69.189.231","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"131.111.8.148","port":25,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"104.47.2.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"216.200.145.235","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"192.254.190.168","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"207.244.88.150","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"104.47.55.161","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"192.110.255.236","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"74.125.69.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"108.177.112.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"66.33.205.212","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"address":"104.47.37.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]}],"dns_resolutions":[{"domain":"126.com","address":"123.126.96.210","ttl":17922,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-02-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"126mx02.mxmail.netease.com","address":"220.181.15.202","ttl":417,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"","ttl":86386,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"aaw.pl","address":"188.128.255.251","ttl":1389,"country":"Poland","registrar_creation_date":"2009-03-10T17:06:21+00:00","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"adatum.com","address":"40.76.4.15","ttl":3599,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_creation_date":"2000-09-27T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"animo.br","ttl":872,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"aol.com","address":"188.125.72.165","ttl":3403,"country":"United Kingdom","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"AOL Inc.","registrar_creation_date":"1995-06-22T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"aspmx2.googlemail.com","address":"173.194.209.26","ttl":292,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2001-07-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"contoso-com.mail.protection.outlook.com","address":"104.47.38.36","ttl":9,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSFT.NET","registrar_creation_date":"1994-08-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"contoso.com","address":"40.76.4.15","ttl":2806,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"contoso.com.br","address":"69.172.201.153","ttl":3599,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"contoso.com.pt","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"contoso.es","address":"213.98.59.242","ttl":21599,"country":"Spain","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"contoso.mx","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"example.com","address":"93.184.216.34","ttl":20931,"country":"European Union","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"example.es","address":"104.247.81.53","ttl":3599,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"example.mx","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"fabrikam.com","address":"40.113.200.201","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"fafa.pk","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"fajrant.qz","ttl":86391,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"fanfary.pq","ttl":86373,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"gmail.com","address":"216.58.194.133","ttl":3558,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"griepp.pl","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"hotmail-com.olc.protection.outlook.com","address":"104.47.55.161","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"hotmail.com","address":"204.79.197.212","ttl":2786,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"kywx.com.pt","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"lufka.zx","ttl":86399,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mail.adatum.com","address":"131.107.88.24","ttl":3252,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mail.fabrikam.com","address":"131.107.55.31","ttl":3042,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"mail.h-email.net","address":"34.222.93.91","ttl":148,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"mail.ru","address":"217.69.139.202","ttl":308,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mail.sexnet.com","address":"45.55.52.96","ttl":774,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"msn-com.olc.protection.outlook.com","address":"104.47.58.33","ttl":19,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mta6.am0.yahoodns.net","address":"67.195.228.109","ttl":23,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"musical.com.br","ttl":783,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mx-aol.mail.gm0.yahoodns.net","address":"98.136.96.92","ttl":12,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mx247.in-mx.com","address":"204.6.193.5","ttl":371,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"mxin.vub.ac.be","address":"134.184.129.114","ttl":10799,"country":"Belgium","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mxs.mail.ru","address":"94.100.180.31","ttl":39,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"oopp.pl","address":"94.152.34.135","ttl":21599,"country":"Poland","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"pirajui.br","ttl":732,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"proseware.com","address":"40.76.4.15","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"quatro.br","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"riekk.pl","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"sexnet.com","address":"45.55.52.96","ttl":13970,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"vade-in2.mail.dreamhost.com","address":"66.33.205.213","ttl":293,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"domain":"vub.ac.be","address":"134.184.129.2","ttl":10799,"country":"Belgium","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"wewew.pl","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"x.com.pt","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"xara.pl","country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"xxv.pq","ttl":86391,"country":"-","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"xyz.com","address":"52.8.203.224","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"xyz.com.br","address":"208.113.184.69","ttl":14399,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"yahoo.com","address":"72.30.35.9","ttl":1441,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"126mx03.mxmail.netease.com","address":"220.181.15.192","ttl":599,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"adobe-com.mail.protection.outlook.com","address":"104.47.44.36","ttl":9,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSFT.NET","registrar_creation_date":"1994-08-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"apple.com","address":"17.178.96.59","ttl":2793,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Apple Inc.","registrar_name_servers":"ADNS1.APPLE.COM","registrar_creation_date":"1987-02-19T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"autoitscript-com.mail.protection.outlook.com","address":"104.47.6.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"autoitscript.com","address":"212.227.91.231","ttl":3599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"bryson.demon.co.uk","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"cl.cam.ac.uk","ttl":14730,"country":"-","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"ismtp.sitestar.everyone.net","address":"216.200.145.235","ttl":257,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"ma1-aaemail-dr-lapp02.apple.com","address":"17.171.2.68","ttl":12687,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mta7.am0.yahoodns.net","address":"67.195.204.74","ttl":26,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mx.cam.ac.uk","address":"131.111.8.146","ttl":3063,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mx1-lw-us.apache.org","address":"207.244.88.150","ttl":1341,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mx2-lw-eu.apache.org","ttl":1467,"country":"-","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mx2-lw-us.apache.org","ttl":1518,"country":"-","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mx247.in-mx.net","address":"192.110.255.228","ttl":580,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"mx8.earthlink.net","address":"207.69.189.231","ttl":713,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"netcom.com","address":"209.86.122.183","ttl":599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"northcoast-com.mail.protection.outlook.com","address":"104.47.0.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"northcoast.com","address":"146.148.85.20","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"onlineconnections.com.au","address":"192.254.190.168","ttl":3232,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"openoffice.org","address":"40.79.78.1","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"pb-mx20.pobox.com","address":"173.228.157.39","ttl":188,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"pobox.com","address":"64.147.108.40","ttl":599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"src.dec.com","ttl":276,"country":"-","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"theriver.com","address":"74.201.226.52","ttl":47,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"domain":"vade-in1.mail.dreamhost.com","address":"66.33.205.212","ttl":208,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}],"processes":[{"pid":1132,"ppid":0,"name":"document.txt.exe","command_line":"","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","normalized_path":"C:\\document.txt.exe","uid":"00074876-00001132","icon":"$2a"},{"pid":2364,"ppid":0,"name":"FVProtect.exe","command_line":"","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","normalized_path":"%WINDIR%\\FVProtect.exe","uid":"00088647-00002364","icon":"$2b"}],"all_imported_dlls":["ntdll.dll","wow64.dll","wow64win.dll","bcryptprimitives.dll","user32.dll","combase.dll","imm32.dll","kernel32.dll","apphelp.dll","ws2_32.dll","rpcrt4.dll","fltLib.dll","msvcp_win.dll","sspicli.dll","cryptbase.dll","gdi32full.dll","advapi32.dll","oleaut32.dll","wow64cpu.dll","KernelBase.dll","sechost.dll","ucrtbase.dll","win32u.dll","gdi32.dll","msvcrt.dll","ole32.dll","wininet.dll","crypt32.dll","msctf.dll","lpk.dll","usp10.dll","urlmon.dll","iertutil.dll","userconfig9x.dll","shlwapi.dll","msasn1.dll","nsi.dll","winhttp.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","FWPUCLNT.DLL","rasadhlp.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","version.dll","NapiNSP.dll","normaliz.dll","dhcpcsvc.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","shell32.dll","webio.dll","dnsapi.dll","mswsock.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","tzres.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","profapi.dll","WSHTCPIP.DLL","nlaapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wship6.dll","winnsi.dll","pnrpnsp.dll","userenv.dll","winrnr.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","secur32.dll","msvcr100.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"userconfig9x.dll","sha256":"9bfaf2f0b53f87d1452d4c2aa75027ffb8e66aee1462c3d9eb7a6e55bcac55c8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"FVProtect.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"base64.tmp","sha256":"d7b4f8b0b593cda11cc419cd1345d95ef257ea6f75626d18770c4c5372c5505e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"FVProtect.exe.bin","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"name":"Microsoft WinXP Crack full.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Harry Potter game.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"DivX 8.0 final.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"MS Service Pack 6.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Doom 3 release 2.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Arnold Schwarzenegger.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Eminem Song text archive.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Ahead Nero 8.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney Spears fuck.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Harry Potter.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney Spears Song text archive.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Eminem Spears porn.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Cracks _ Warez Archiv.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Teen Porn 15.jpg.pif","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Learn Programming 2004.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"How to hack new.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Visual Studio Net Crack all.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Eminem full album.mp3.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Adobe Premiere 10.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"1001 Sex and more.rtf.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Kazaa Lite 4.0 new.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Opera 11.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Microsoft Office 2003 Crack best.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney Spears and Eminem porn.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney Spears cumshot.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Win Longhorn re.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"WinXP eBook newest.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney Spears Sexy archive.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney Spears.mp3.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"RFC compilation.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"ACDSee 10.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Windows 2000 Sourcecode.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Internet Explorer 9 setup.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney Spears porn.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Eminem Sexy archive.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Kazaa new.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Dictionary English 2004 - France.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Harry Potter 5.mpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Clone DVD 6.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Magix Video Deluxe 5 beta.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Dark Angels new.pif","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Partitionsmagic 10 beta.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Eminem.mp3.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Adobe Photoshop 10 crack.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Harry Potter all e.book.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Gimp 1.8 Full with Key.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Ringtones.mp3.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney Spears blowjob.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Norton Antivirus 2005 beta.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"3D Studio Max 6 3dsmax.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Altkins Diet.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Lightwave 9 Update.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Eminem sex xxx.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"The Sims 4 beta.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Serials edition.txt.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"WinAmp 13 full.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Windows XP crack.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Adobe Photoshop 10 full.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"XXX hardcore pics.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Eminem blowjob.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Ringtones.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney Spears.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Star Office 9.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney sex xxx.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Ulead Keygen 2004.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Smashing the stack full.rtf.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Windows 2003 crack.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Eminem Poster.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Matrix.mpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Harry Potter 1-6 book.txt.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"E-Book Archive2.rtf.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Cloning.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Britney Spears full album.mp3.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Harry Potter e book.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Full album all.mp3.pif","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"American Idol.doc.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Keygen 4 all new.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"Saddam Hussein.jpg.exe","sha256":"c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"zip1.tmp","sha256":"c551ab36076cd1c4637f17c830c9d58db4f3d07279aa4ac59edfa6c0cc279e17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"zip2.tmp","sha256":"8232a16080156cf9b8e49e7c4bdd14348dd089918efb80890b345d1959f58994","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"zip3.tmp","sha256":"84b9c139288aec2611c196b4e2dd0a0854639da634b77fe927e0932511f122c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"zipped.tmp","sha256":"8f5915cc94c67edb93c07bb5ebfd36b1ebd1b149bb1ca90e720867589996e215","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]}],"files_written":[{"path":"%WINDIR%\\FVProtect.exe","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"}]},{"path":"C:\\message.scr.exe","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"}]},{"path":"%WINDIR%\\base64.tmp","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%WINDIR%\\zip3.tmp","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\StandardrWW.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%PROGRAMFILES%\\7-Zip\\History.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\af.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\an.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ar.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ast.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\az.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ba.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bg.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bn.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\br.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ca.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\co.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ext.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fa.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fi.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fr.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fur.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fy.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ga.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gl.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gu.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\he.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hi.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hr.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hu.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hy.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\id.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\io.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\is.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\it.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ja.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ka.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kaa.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kk.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ko.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku-ckb.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ky.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lij.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lt.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lv.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mk.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mn.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng2.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mr.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ms.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nb.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ne.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nl.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nn.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pa-in.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscat.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipschs.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscht.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscsy.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipshrv.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsita.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsjpn.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipskor.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsnld.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsnor.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsplk.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsptb.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsptg.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsrom.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsrus.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssrb.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssrl.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssve.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\document.txt.exe","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\document.txt.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%WINDIR%\\FVProtect.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%WINDIR%\\zipped.tmp","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%WINDIR%\\zip1.tmp","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%WINDIR%\\zip2.tmp","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\Office32WW.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\be.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cs.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cy.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\da.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\de.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\el.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eo.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\es.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\et.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eu.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pl.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ps.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt-br.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ro.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ru.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sa.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\si.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sk.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sl.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sq.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spc.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spl.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sv.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ta.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\th.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tr.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tt.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ug.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uk.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uz.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\va.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\vi.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\yo.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-cn.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-tw.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\License.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\7-Zip\\readme.txt","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\Alphabet.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\Content.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsdan.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsdeu.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsen.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsesp.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsfin.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsfra.xml","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"path":"C:\\c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525_1574770955191_message.scr.exe","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525_1574770955191_message.scr.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\branding.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUI.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-0000-0000000FF1CE}-C\\StandardrWW.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\COPYING.LGPLv2.1.txt","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\plugins.js","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\license.html","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\base_uris.js","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\init.js","sources":[{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\EXPLORER\\EXPLORER","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\EXPLORER\\EXPLORER","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\SYSTEM.\\SYSTEM.","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\MSGSVR32\\MSGSVR32","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\AU.EXE\\AU.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WINUPD.EXE\\WINUPD.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\DIRECT.EXE\\DIRECT.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\DIRECT.EXE\\DIRECT.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\JIJBL\\JIJBL","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\VIDEO\\VIDEO","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\SERVICE\\SERVICE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\DELETE ME\\DELETE ME","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\D3DUPDATE.EXE\\D3DUPDATE.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\OLE\\OLE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\SENTRY\\SENTRY","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\GOUDAY.EXE\\GOUDAY.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\RATE.EXE\\RATE.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\TASKMON\\TASKMON","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\TASKMON\\TASKMON","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WINDOWS SERVICES HOST\\WINDOWS SERVICES HOST","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WINDOWS SERVICES HOST\\WINDOWS SERVICES HOST","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\SYSMON.EXE\\SYSMON.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\SRATE.EXE\\SRATE.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\SSATE.EXE\\SSATE.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WINUPD.EXE\\WINUPD.EXE","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\EXPLORER\\EXPLORER","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\SYSTEM.\\SYSTEM.","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\MSGSVR32\\MSGSVR32","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WINUPD.EXE\\WINUPD.EXE","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\DIRECT.EXE\\DIRECT.EXE","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\JIJBL\\JIJBL","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\VIDEO\\VIDEO","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\SERVICE\\SERVICE","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\DELETE ME\\DELETE ME","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\SENTRY\\SENTRY","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\TASKMON\\TASKMON","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WINDOWS SERVICES HOST\\WINDOWS SERVICES HOST","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\'D'r'o'p'p'e'd'S'k'y'N'e't'","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_","sources":[{"report_type":"sandbox","report_id":"56d05725aac2ed8f777b23c8"},{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"_-oO]xX|-S-k-y-N-e-t-|Xx[Oo-_","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]},{"name":"'D'r'o'p'p'e'd'S'k'y'N'e't'","sources":[{"report_type":"sandbox","report_id":"5f1e1c89e098e2768163a18f"},{"report_type":"sandbox","report_id":"5730bd90aac2ed6e5a6de021"}]}]}},"report_ids":{"sandbox_job_ids":["63e3b7ee583d7128542128e7","5f1e1c89e098e2768163a18f","5730bd90aac2ed6e5a6de021","56d05725aac2ed8f777b23c8","55785b828690b87039d34597"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Worm.NetSky Sample c8fffb2e7375… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c8fffb2e7375…. Malware family: Worm.NetSky. Threat score 100/100. 26/27 AV engines flagged this file. 14 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525"}],["$","meta","4",{"property":"og:title","content":"Malicious Worm.NetSky Sample c8fffb2e7375… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c8fffb2e7375…. Malware family: Worm.NetSky. Threat score 100/100. 26/27 AV engines flagged this file. 14 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c8fffb2e737514c551b2d7bcaf8baa459564b059cab1a35a3cec4b3c270d4525"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Worm.NetSky Sample c8fffb2e7375… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c8fffb2e7375…. Malware family: Worm.NetSky. Threat score 100/100. 26/27 AV engines flagged this file. 14 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]