23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TROJ_KOVTER.SMVB Sample d6dfe0521d13… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d6dfe0521d13…. Malware family: TROJ_KOVTER.SMVB. Threat score 100/100. 22/28 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d6dfe0521d13b069864b93d77a5465706f1544fd78b5c6bd556fa37d7ca0a7b0","keywords":["Malicious","TROJ_KOVTER.SMVB","malware analysis","sandbox report","threat intelligence","d6dfe0521d13b069864b93d77a5465706f1544fd78b5c6bd556fa37d7ca0a7b0"],"about":{"@type":"SoftwareApplication","name":"FirefoxUpdate.exe","applicationCategory":["peexe","executable"],"identifier":"d6dfe0521d13b069864b93d77a5465706f1544fd78b5c6bd556fa37d7ca0a7b0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TROJ_KOVTER.SMVB","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T400,"POST /1ksd2uve/index.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mlewipzrm.in User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 10856" with no payload "POST /1ksd2uve/index.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mlewipzrm.in User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 10843" with no payload "POST /1ksd2uve/index.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mlewipzrm.in User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 10860" with no payload25:T4c6,"" wrote 1500 bytes to a foreign process "FirefoxUpdate.exe" (PID: 00002424) "" wrote 4 bytes to a foreign process "FirefoxUpdate.exe" (PID: 00002424) "" wrote 32 bytes to a foreign process "FirefoxUpdate.exe" (PID: 00002424) "" wrote 52 bytes to a foreign process "FirefoxUpdate.exe" (PID: 00002424) "" wrote 512 bytes to a foreign process "FirefoxUpdate.exe" (PID: 00002424) "" wrote 1 bytes to a foreign process "FirefoxUpdate.exe" (PID: 00002424) "" wrote 1500 bytes to a foreign process "rundll32.exe" (PID: 00002456) "" wrote 4 bytes to a foreign process "rundll32.exe" (PID: 00002456) "" wrote 32 bytes to a foreign process "rundll32.exe" (PID: 00002456) "" wrote 52 bytes to a foreign process "rundll32.exe" (PID: 00002456) "" wrote 2 bytes to a foreign process "rundll32.exe" (PID: 00002456) "" wrote 536344 bytes to a foreign process "rundll32.exe" (PID: 00002456) "" wrote 16 bytes to a foreign process "rundll32.exe" (PID: 00002456) "" wrote 1 bytes to a foreign process "rundll32.exe" (PID: 00002456)26:T63c,Spawned process "" (UID: 00008472-00002400) Spawned process "" (UID: 00009962-00002636) Spawned process "winlogon.exe" (UID: 00010368-00000460) Spawned process "services.exe" (UID: 00010369-00000516) Spawned process "lsass.exe" (UID: 00010371-00000524) Spawned process "lsm.exe" (UID: 00010374-00000532) Spawned process "svchost.exe" with commandline "-k DcomLaunch" (UID: 00010380-00000624) Spawned process "svchost.exe" with commandline "-k LocalSystemNetworkRestricted" (UID: 00010462-00000892) Spawned process "svchost.exe" with commandline "-k netsvcs" (UID: 00010464-00000932) Spawned process "spoolsv.exe" (UID: 00010468-00001264) Spawned process "taskhost.exe" (UID: 00010473-00001460) Spawned process "Explorer.EXE" (UID: 00010543-00001488) Spawned process "conhost.exe" (UID: 00010555-00001228) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00010659-00002700) Spawned process "cmd.exe" (UID: 00010665-00001480) Spawned process "wmiprvse.exe" (UID: 00010673-00000356) Spawned process "msiexec.exe" with commandline "/V" (UID: 00010676-00002060) Spawned process "conhost.exe" (UID: 00010794-00003780) Spawned process "conhost.exe" (UID: 00010993-00002224) Spawned process "mscorsvw.exe" (UID: 00010995-00002344) Spawned process "svchost.exe" with commandline "-k WerSvcGroup" (UID: 00011176-00003868) Spawned process "conhost.exe" (UID: 00011893-00003932) Spawned process "DllHost.exe" with commandline "/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" (UID: 00013060-00003416)1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"d6dfe0521d13b069864b93d77a5465706f1544fd78b5c6bd556fa37d7ca0a7b0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790444593788,"unified_at":"2026-09-26T17:43:13.788Z","metadata":{"hashes":{"sha256":"d6dfe0521d13b069864b93d77a5465706f1544fd78b5c6bd556fa37d7ca0a7b0","sha1":"3f500a11db5ea5ce13a95cda948703543fb41532","md5":"592899e0eb3c06fb9fda59d03e4b5b53","sha512":"f314949d32425623afd5117bb888f8289ed1125ebcd883c33a7ce6f4594c77803c432152f1f71731e207a0451e596400ff436968df453cc6769da0d6d6f1123a","ssdeep":"12288:zwZwMTXsLH6obaulLy5gpMq0IgqDSQsX/4dklbBRrhguPYYKR7BFfswH:zawMTXsLH6dK+RGDDncQaHEYU/","ssdeep_chunks":["12288:zwZwMTX","12288:wZwMTXs","12288:ZwMTXsL","12288:wMTXsLH","12288:MTXsLH6","12288:TXsLH6o","12288:XsLH6ob","12288:sLH6oba","12288:LH6obau","12288:H6obaul","12288:6obaulL","12288:obaulLy","12288:baulLy5","12288:aulLy5g","12288:ulLy5gp","12288:lLy5gpM","12288:Ly5gpMq","12288:y5gpMq0","12288:5gpMq0I","12288:gpMq0Ig","12288:pMq0Igq","12288:Mq0IgqD","12288:q0IgqDS","12288:0IgqDSQ","12288:IgqDSQs","12288:gqDSQsX","12288:qDSQsX/","12288:DSQsX/4","12288:SQsX/4d","12288:QsX/4dk","12288:sX/4dkl","12288:X/4dklb","12288:/4dklbB","12288:4dklbBR","12288:dklbBRr","12288:klbBRrh","12288:lbBRrhg","12288:bBRrhgu","12288:BRrhguP","12288:RrhguPY","12288:rhguPYY","12288:hguPYYK","12288:guPYYKR","12288:uPYYKR7","12288:PYYKR7B","12288:YYKR7BF","12288:YKR7BFf","12288:KR7BFfs","12288:R7BFfsw","12288:7BFfswH","24576:zwZwMTX","24576:wZwMTXs","24576:ZwMTXsL","24576:wMTXsLH","24576:MTXsLH6","24576:TXsLH6o","24576:XsLH6ob","24576:sLH6oba","24576:LH6obau","24576:H6obaul","24576:6obaulL","24576:obaulLy","24576:baulLy5","24576:aulLy5g","24576:ulLy5gp","24576:lLy5gpM","24576:Ly5gpMq","24576:y5gpMq0","24576:5gpMq0I","24576:gpMq0Ig","24576:pMq0Igq","24576:Mq0IgqD","24576:q0IgqDS","24576:0IgqDSQ","24576:IgqDSQs","24576:gqDSQsX","24576:qDSQsX/","24576:DSQsX/4","24576:SQsX/4d","24576:QsX/4dk","24576:sX/4dkl","24576:X/4dklb","24576:/4dklbB","24576:4dklbBR","24576:dklbBRr","24576:klbBRrh","24576:lbBRrhg","24576:bBRrhgu","24576:BRrhguP","24576:RrhguPY","24576:rhguPYY","24576:hguPYYK","24576:guPYYKR","24576:uPYYKR7","24576:PYYKR7B","24576:YYKR7BF","24576:YKR7BFf","24576:KR7BFfs","24576:R7BFfsw","24576:7BFfswH","12288:zawMTXs","12288:awMTXsL","12288:TXsLH6d","12288:XsLH6dK","12288:sLH6dK+","12288:LH6dK+R","12288:H6dK+RG","12288:6dK+RGD","12288:dK+RGDD","12288:K+RGDDn","12288:+RGDDnc","12288:RGDDncQ","12288:GDDncQa","12288:DDncQaH","12288:DncQaHE","12288:ncQaHEY","12288:cQaHEYU","12288:QaHEYU/"],"imphash":"3e10936070ade05395b8d42f1ada604b"},"file_info":{"file_name":"FirefoxUpdate.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":638976,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297041000,"last_seen":1677394805000,"last_multi_scan":1677394805000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":17,"malicious_count":9,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/VBKrypt.RP08","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/Win32.Zbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.VB.42485","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BOOJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.KSAW-7549","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BOOJ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.Nymaim.BA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/VB.Obfuscator.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 004d4b861 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Zbot.weye","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dwn.efgugd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-APLQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_KOVTER.SMVB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_KOVTER.SMVB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zyx.AQN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Nymaim.Win32.7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TROJ_KOVTER.SMVB","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"\" loaded module \"C:\\Windows\\system32\\MSVBVM60.DLL\" at 72940000","origin":"Loaded Module","id":"module-0","sources":[{"report_type":"sandbox","report_id":"565c44610e316d5958e6367c"},{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"SCHEDLGU.TXT\" has type \"Little-endian UTF-16 Unicode text, with CRLF, CR line terminators\"\n \"setupact.log\" has type \"ASCII text, with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"565c44610e316d5958e6367c"},{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.4602729432","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"565c44610e316d5958e6367c"},{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"Installation/Persistance","name":"File system monitor detected changes at critical system location","description":"Found a system modification for file \"SCHEDLGU.TXT\" (Context: \"C:\\Windows\\Tasks\\SCHEDLGU.TXT\", Type: \"Little-endian UTF-16 Unicode text, with CRLF, CR line terminators\", Additional Info: Existing file modified)\n Found a system modification for file \"setupact.log\" (Context: \"C:\\Windows\\setupact.log\", Type: \"ASCII text, with CRLF line terminators\", Additional Info: Existing file modified)","origin":"Binary File","relevance":5,"id":"binary-13","sources":[{"report_type":"sandbox","report_id":"565c44610e316d5958e6367c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 700959 does not match actual CRC 649086","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"565c44610e316d5958e6367c"},{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/55 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"565c44610e316d5958e6367c"},{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"mlewipzrm.in\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"188.209.52.228:80\"\n \"95.173.164.212:80\"\n \"89.163.249.75:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Global\\{D080400C-CD0B-04E7-29E4-C841B4066644}\"\n \"Global\\{B8236F38-ADBC-2C58-E5F4-592A77F8381F}\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"NTDLL\" at base 77420000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\APPHELP.DLL\" at base 75470000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"ZwAllocateVirtualMemory@ntdll.dll\"\n \"ShellExecuteW@SHELL32.dll\"\n \"RegOpenKeyExA@ADVAPI32.dll\"\n \"RegQueryValueExW@ADVAPI32.dll\"\n \"RegCloseKey@ADVAPI32.dll\"\n \"NtUnmapViewOfSection@ntdll.dll\"\n \"NtWriteVirtualMemory@ntdll.dll\"\n \"NtGetContextThread@ntdll.dll\"\n \"NtSetContextThread@ntdll.dll\"\n \"NtResumeThread@ntdll.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00175375-00002424)\n Spawned process \"rundll32.exe\" with commandline \"-r bzwfrbz.dll\" (UID: 00177468-00002456)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")\n \"rundll32.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$24","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to create a remote thread (often used for process injection)","description":"CreateRemoteThread@KERNEL32.DLL at 00157078-00002220-7748228D-175492","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-5","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"EntryPoint@rundll32.exe\" in \"rundll32.exe\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"rundll32.exe\" wrote bytes \"E802FEFFFF6A5C68A0189700E86F0600\" to virtual address \"0x0097178C\" (\"EntryPoint@rundll32.exe\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00001500 bytes of memory in \"FirefoxUpdate.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"FirefoxUpdate.exe\" (Protection: \"read/write\")\n \"\" allocated 00548864 bytes of memory in \"FirefoxUpdate.exe\" (Protection: \"execute/read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$25","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ZwShutdownSystem@NTDLL.DLL at 00175375-00002424-61546-659-004226B1\n ZwShutdownSystem@NTDLL.DLL at 00175375-00002424-135-659-004226B1","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtAllocateVirtualMemory@NTDLL.DLL at 00157078-00002220-7748228D-175286\n NtUnmapViewOfSection@NTDLL.DLL at 00157078-00002220-7748228D-175458\n NtWriteVirtualMemory@NTDLL.DLL at 00157078-00002220-7748228D-175466\n NtGetContextThread@NTDLL.DLL at 00157078-00002220-7748228D-175477\n NtSetContextThread@NTDLL.DLL at 00157078-00002220-7748228D-175485\n NtResumeThread@NTDLL.DLL at 00157078-00002220-7748228D-177349\n ZwShutdownSystem@NTDLL.DLL at 00175375-00002424-61546-659-004226B1\n ZwShutdownSystem@NTDLL.DLL at 00175375-00002424-135-659-004226B1","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"java.exe\" is protecting 4194304 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\", Key: \"COMPUTERNAME\")\n \"java.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\", Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"java.exe\" sleeping for \"00178178\" milliseconds\n \"java.exe\" sleeping for \"00136238\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\AppPatch\\AcGenral.DLL\"\n \"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"C:\\Windows\\Fonts\\staticcache.dat\"\n \"\" created file \"C:\\Windows\\system32\\rundll32.exe\"\n \"VxKernelSvcNTMgr.exe\" created file \"C:\\Windows\\system32\\WerFault.exe\"\n \"java.exe\" created file \"C:\\Windows\\System32\\azman.msc\"\n \"java.exe\" created file \"C:\\Windows\\System32\\azroles.dll\"\n \"java.exe\" created file \"C:\\Windows\\System32\\azroleui.dll\"\n \"java.exe\" created file \"C:\\Windows\\System32\\AzSqlExt.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\FirefoxUpdate.exe\" marked \"\\Device\\HarddiskVolume2\\ProgramData\\58q3iq3\" for deletion\n \"C:\\FirefoxUpdate.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Roaming\\khf\" for deletion\n \"C:\\FirefoxUpdate.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\21x\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00010543-00001488)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects itself into other processes","description":"Injected into \"VxKernelSvcNTMgr.exe\" at 2015-11-30.06:35:31.219 (UID: 00010919-00002212)\n Injected into \"java.exe\" at 2015-11-30.06:35:46.469 (UID: 00011896-00004016)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"30/11/2015 06:35:27.468 INFO [VxKernelSvcNtMgr, 2440] Found injected process \"C:\\Windows\\system32\\lsass.exe\" (Type: INJECT_NOMONITOR)\"","origin":"File/Memory","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$26","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]}],"incidents":[{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Injects into explorer"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]}]},"activity":{"stats":{"process_count":26,"spawned_processes_count":26,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":1352,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Extracted Files","Sample Crashed","Network Traffic","Sample not shared"],"sandbox_reports":[{"id":"565c5e140e316d2103745917","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.A19773F50","contacted_countries":["DEU","NLD","TUR"],"submit_name":"FirefoxUpdate.exe","analysis_start_time":"2015-11-30T08:33:10+00:00","indicators_count":{"informative":7,"suspicious":15,"malicious":6},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"565c44610e316d5958e6367c","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"suspicious","threat_score":31,"malware_family":"Trojan.A19773F50","submit_name":"flashplayer19_ga_update.exe","analysis_start_time":"2015-11-30T07:53:27+00:00","indicators_count":{"informative":2,"suspicious":3,"malicious":1},"tags":["Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"565c312a0e316d5967b483a3","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":97,"malware_family":"Trojan.A19773F50","contacted_countries":["DEU","NLD","TUR"],"submit_name":"FirefoxUpdate.exe","analysis_start_time":"2015-11-30T08:49:26+00:00","indicators_count":{"informative":8,"suspicious":10,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"188.209.52.228","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"address":"95.173.164.212","port":80,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"address":"89.163.249.75","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]}],"dns_resolutions":[{"domain":"mlewipzrm.in","address":"89.163.249.75","country":"Germany","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]}],"http_requests":[{"host":"mlewipzrm.in","host_ip":"188.209.52.228:80","url":"/1ksd2uve/index.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}],"processes":[{"pid":460,"ppid":0,"name":"winlogon.exe","command_line":"","normalized_path":"","uid":"00010368-00000460","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":516,"ppid":0,"name":"services.exe","command_line":"","normalized_path":"","uid":"00010369-00000516","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":524,"ppid":0,"name":"lsass.exe","command_line":"","normalized_path":"","uid":"00010371-00000524","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":532,"ppid":0,"name":"lsm.exe","command_line":"","normalized_path":"","uid":"00010374-00000532","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":624,"ppid":0,"name":"svchost.exe","command_line":"-k DcomLaunch","normalized_path":"","uid":"00010380-00000624","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":892,"ppid":0,"name":"svchost.exe","command_line":"-k LocalSystemNetworkRestricted","normalized_path":"","uid":"00010462-00000892","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":932,"ppid":0,"name":"svchost.exe","command_line":"-k netsvcs","normalized_path":"","uid":"00010464-00000932","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":1264,"ppid":0,"name":"spoolsv.exe","command_line":"","normalized_path":"","uid":"00010468-00001264","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":1460,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00010473-00001460"},{"pid":1488,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00010543-00001488","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":1228,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00010555-00001228"},{"pid":2700,"ppid":0,"name":"DllHost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","normalized_path":"","uid":"00010659-00002700","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":1480,"ppid":0,"name":"cmd.exe","command_line":"","normalized_path":"","uid":"00010665-00001480","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":356,"ppid":0,"name":"wmiprvse.exe","command_line":"","normalized_path":"","uid":"00010673-00000356","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":2060,"ppid":0,"name":"msiexec.exe","command_line":"/V","normalized_path":"","uid":"00010676-00002060","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":3780,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00010794-00003780"},{"pid":2212,"ppid":0,"name":"VxKernelSvcNTMgr.exe","command_line":"","normalized_path":"","uid":"00010919-00002212","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":2400,"ppid":0,"name":"FirefoxUpdate.exe","command_line":"","normalized_path":"","uid":"00008472-00002400"},{"pid":2636,"ppid":0,"name":"FirefoxUpdate.exe","command_line":"","normalized_path":"","uid":"00009962-00002636"},{"pid":2736,"ppid":0,"name":"rundll32.exe","command_line":"-i umzikqc.dll","normalized_path":"","uid":"00010285-00002736"},{"pid":2224,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00010993-00002224"},{"pid":2344,"ppid":0,"name":"mscorsvw.exe","command_line":"","normalized_path":"","uid":"00010995-00002344","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":3868,"ppid":0,"name":"svchost.exe","command_line":"-k WerSvcGroup","normalized_path":"","uid":"00011176-00003868","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":3932,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00011893-00003932"},{"pid":4016,"ppid":0,"name":"java.exe","command_line":"","normalized_path":"","uid":"00011896-00004016","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="},{"pid":3416,"ppid":0,"name":"DllHost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","normalized_path":"","uid":"00013060-00003416","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFnSURBVFhH7ZfNSwJBGMb9b6Jb4TWQIMykk4JSWVkzh+yD7AOsDmJRGSgWiQdn/9jpJ+y2w4x7CHb7oBF+6OzrzD7zzBzeJyeDQIue0jnrI1pKixt4h35cF6+MB9CGi/D3aM78DrVjeISJMf+e8RS6IHj+ZwU4jl2xozNjp1k78GMCohcn3QHxEt6brBz4dQKco/huBzIXYL/APgIvwDvgHfAOeAe8A96B/+dAlAs++4JZRjByQao9YZNg4lgcBpMkAXu0ZLuEmWYaTWnFENA4ZafXkJCMBLlgm1xQREABAdU0BJQMAdUjpfeJY4fYbUezgyG1c6UrxLn8s9KLCCinIaCGgCKLFfheKStd2nKPJDqK9Tr/2Yzr9TQEROF0A2sXltjdWrKA5VV2ns8omtXu4oUbs77fSsc72O5c1q84IHuBs4BsBVrewhj6cV2+MR5AGy5hCKM58zs8P4EnmBjzHxhPoQsy0B//0X5JNfaVZwAAAABJRU5ErkJggg=="}],"all_imported_dlls":["AcGenral.DLL","dwmapi.dll","kernel32.dll","VERSION.dll","SspiCli.dll","CFGMGR32.dll","PSAPI.DLL","DEVOBJ.dll","KERNELBASE.dll","samcli.dll","USERENV.dll","SETUPAPI.dll","ADVAPI32.dll","CRYPT32.dll","CRYPTBASE.dll","RPCRT4.dll","MSCTF.dll","MSASN1.dll","sfc_os.DLL","MPR.dll","USP10.dll","UxTheme.dll","urlmon.dll","apphelp.dll","sfc.dll","SHLWAPI.dll","LPK.dll","IMM32.DLL","USER32.dll","WINMM.dll","ntdll.dll","sechost.dll","MSVBVM60.DLL","MSACM32.dll","SHELL32.dll","WININET.dll","msvcrt.dll","OLEAUT32.dll","profapi.dll","GDI32.dll","ole32.dll","iertutil.dll","AcLayers.DLL","SXS.DLL","imagehlp.dll","gdi32.dll","rpcrt4.dll","crypt32.dll","comctl32.dll","KernelBase.dll","advapi32.dll","winmm.dll","setupapi.dll","version.dll","imm32.dll","msctf.dll","msvbvm60.dll","oleaut32.dll","sfc_os.dll","sxs.dll","user32.dll","lpk.dll","shell32.dll","msasn1.dll","shlwapi.dll","msacm32.dll","cfgmgr32.dll","sspicli.dll","wininet.dll","mpr.dll","usp10.dll","AcGenral.dll","uxtheme.dll","userenv.dll","devobj.dll","cryptbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SCHEDLGU.TXT","sha256":"c715208a02d284147b1a566029e4e45051af9ad6488c876c7c3823e36d8eb05a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c44610e316d5958e6367c"}]},{"name":"setupact.log","sha256":"63efe8f685c48b9e9e9eafc9e5804501713e469b7f484553f52f0ad398d3dd58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c44610e316d5958e6367c"}]},{"name":"rzf.gjc","sha256":"5c795e7745ab29366ae97d34ce9fa818715762bd4f77700345c48d32892c0853","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"luuoqyg.gde","sha256":"466760bfae275dbf59811c89ccab1f90e43423258ebe559d3e3cd4067436f43e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"vxkernelsvc.log","sha256":"f828839989aab2e6acfe64663cf83173e3a3480c802a748fbdc54f33f55ae439","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"3b72q7","sha256":"3addfb141cd7c9c4c6543a82191a3707ac29c7a041217782e61d4d91c691aee8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"8B1F.tmp","sha256":"0a88111852095cae045340ea1f0b279944b2a756a213d9b50107d7489771e159","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"8B6E.tmp","sha256":"df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"m9i0","sha256":"61126de1b795b976f3ac878f48e88fa77a87d7308ba57c7642b9e1068403a496","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"nhim","sha256":"de47c9b27eb8d300dbb5f2c353e632c393262cf06340c4fa7f1b40c4cbd36f90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"41oqa","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"RecentFileCache.bcf","sha256":"711ca7ef213e80598dee41b08dc530e44a9a494ec7c7befde286a8f104536828","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"CMD.EXE-4A81B364.pf","sha256":"53954898e5daa11c3ab285f1ff6f8ef4d4e9d8a5c5fc1a861e3b8bb689ff84da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"CONHOST.EXE-1F3E9D7E.pf","sha256":"ee9852934363e1aaeb836fedeca615b01c5609d8dd2431a2173115149921e020","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"DLLHOST.EXE-766398D2.pf","sha256":"9bbc998e7f07a1124b52f038029903dd8a79729479a573f4f87acdec5b99f214","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"SVCHOST.EXE-80F4A784.pf","sha256":"f7b9ac314436b9f2951012f8987920fb274f40b2fa8900881e8ef12deb5e403d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"vxmon.log","sha256":"b6eaa41653ddb19db4785e442dc4754d834c762cb1d19e20109a3b7c57e6325f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]}],"files_written":[{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%SAMPLEDIR%\\FirefoxUpdate.exe","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\system32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%ALLUSERSPROFILE%\\46v82a","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"path":"%LOCALAPPDATA%\\q4242rp","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"path":"%APPDATA%\\0ip9h5","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"path":"%ALLUSERSPROFILE%\\uoi","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%ALLUSERSPROFILE%\\uoi\\rzf.gjc","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%TEMP%\\luuoqyg.gde","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"pipe\\{CC026958-18CB-C4C8-DDB2-938A26E2ED19}","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%ALLUSERSPROFILE%\\58q3iq3","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%APPDATA%\\khf","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%LOCALAPPDATA%\\21x","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"pipe\\{8285A86E-74FC-1946-EB1A-81A442D52134}","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\Prefetch\\SVCHOST.EXE-80F4A784.pf","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\Prefetch\\CMD.EXE-4A81B364.pf","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\Prefetch\\CONHOST.EXE-1F3E9D7E.pf","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\Prefetch\\DLLHOST.EXE-766398D2.pf","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\AppCompat\\Programs\\RecentFileCache.bcf","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%TEMP%\\8B1F.tmp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%TEMP%\\8B6E.tmp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%ALLUSERSPROFILE%\\3b72q7","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%APPDATA%\\41oqa","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%LOCALAPPDATA%\\nhim","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%TEMP%\\m9i0","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"C:\\analysis\\0\\.exit","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\system32\\WerFault.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"C:\\FirefoxUpdate.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\12520437.cpx","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\12520850.cpx","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\aaclient.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\accessibilitycpl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ACCTRES.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\acledit.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\aclui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\acppage.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\acproxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ActionCenter.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ActionCenterCPL.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ActionQueue.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\activeds.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\activeds.tlb","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\actxprxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AdapterTroubleshooter.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\admparse.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\adprovider.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\adsldp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\adsldpc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\adsmsext.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\adsnt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\adtschema.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\advapi32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\advpack.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\aecache.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\aeevts.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\aeinv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\aelupsvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\aepdu.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\aepic.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\aitagent.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\alg.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AltTab.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\amcompat.tlb","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\amstream.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\amxread.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ANSI.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\apds.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-delayload-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-fibers-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-io-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-localization-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-localregistry-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-misc-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-threadpool-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-core-xstate-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-security-base-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-security-lsalookup-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-security-sddl-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-service-core-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-service-management-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-service-management-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\api-ms-win-service-winsvc-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\apilogen.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\apircl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\apisetschema.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\append.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\apphelp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Apphlpdm.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\appidapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\appidcertstorecheck.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\appidpolicyconverter.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\appidsvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\appinfo.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\appverif.chm","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\appverif.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\appverif.ico","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\appverif.pdb","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\appwiz.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\apss.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ARP.EXE","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\asferror.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\aspnet_counters.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\asycfilt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\at.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AtBroker.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\atl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\atl100.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\atmfd.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\atmlib.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\attrib.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\audiodev.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\audiodg.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AudioEng.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AUDIOKSE.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AudioSes.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\audiosrv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\auditcse.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\auditpol.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\authfwcfg.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AuthFWGP.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AuthFWSnapin.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AuthFWWizFwk.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\authui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\authz.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\autochk.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\autoconv.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\autoexec.nt","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\autofmt.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\autoplay.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AuxiliaryDisplayApi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AuxiliaryDisplayClassInstaller.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AuxiliaryDisplayCpl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AuxiliaryDisplayDriverLib.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AuxiliaryDisplayServices.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\avicap.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\avicap32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\avifil32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\avifile.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\avrt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AxInstSv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AxInstUI.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\azman.msc","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\azroles.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\azroleui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\AzSqlExt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\basecsp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\basesrv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\batmeter.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\batt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bcdboot.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bcdprov.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bcdsrv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bcrypt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bcryptprimitives.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bdaplgin.ax","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bderepair.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bdesvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bdeui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\BdeUISrv.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\BdeUnlockWizard.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\BFE.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bidispl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\biocpl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\BioCredProv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bios1.rom","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bios4.rom","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bitsadmin.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bitsigd.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bitsperf.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bitsprx2.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bitsprx3.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bitsprx4.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bitsprx5.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bitsprx6.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\blackbox.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\BlbEvents.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\blbres.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\blb_ps.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\boot.sdi","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bootcfg.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bootres.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bootstr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\BOOTVID.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bopomofo.uce","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\brcoinst.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\brdgcfg.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bridgeres.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bridgeunattend.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\browcli.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\browser.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\browseui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bthci.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\BthMtpContextHandler.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bthpanapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\BthpanContextHandler.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bthprops.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bthserv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\bthudtask.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\btpanui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Bubbles.scr","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\BWContextHandler.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\BWUnpairElevated.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cabinet.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cabview.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cacls.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\calc.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\capiprovider.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\capisp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\CardGames.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\catsrv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\catsrvps.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\catsrvut.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cca.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cdd.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cdosys.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cero.rs","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\certcli.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\certCredProvider.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\certenc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\CertEnroll.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\CertEnrollCtrl.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\CertEnrollUI.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\certmgr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\certmgr.msc","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\CertPolEng.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\certprop.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\certreq.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\certutil.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cewmdm.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cfgbkend.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cfgmgr32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\chajei.ime","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\charmap.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\chcp.com","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\chkdsk.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\chkntfs.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\chkwudrv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\choice.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\chsbrkr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\chtbrkr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\CHxReadingStringIME.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ci.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cic.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cintlgnt.ime","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cipher.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\CIRCoInst.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\clb.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\clbcatq.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cleanmgr.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\clfs.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\clfsw32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cliconfg.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cliconfg.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cliconfg.rll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\clip.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\clusapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmcfg32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmdial32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmdkey.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmdl32.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmicryptinstall.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmifw.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmipnpinstall.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmlua.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmmon32.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmncliM.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmpbk32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmstp.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmstplua.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cmutil.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cngaudit.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cngprovider.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cnvfat.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cofire.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cofiredm.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\colbact.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\collab.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\COLORCNV.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\colorcpl.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\colorui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\comcat.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\comctl32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\comdlg32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\comexp.msc","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\COMM.drv","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\COMMAND.COM","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\COMMDLG.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\comp.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\compact.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\compmgmt.msc","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\CompMgmtLauncher.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\compobj.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\compstui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ComputerDefaults.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\comrepl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\comres.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\comsnap.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\comsvcs.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\comuid.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\config.nt","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\connect.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\consent.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\console.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\control.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\convert.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\corpol.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\correngine.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\country.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\CPFilters.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\credssp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\credui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\credwiz.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\crtdll.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\crypt32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cryptbase.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cryptdlg.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cryptdll.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cryptext.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cryptnet.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cryptsp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cryptsvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cryptui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cryptxml.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cscapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cscdll.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cscript.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\csrr.rs","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\csrsrv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\csrstub.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ctfmon.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ctl3d32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ctl3dv2.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cttune.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\cttunesvr.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_037.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10000.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10001.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10002.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10003.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10004.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10005.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10006.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10007.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10008.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10010.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10017.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10021.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10029.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10079.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10081.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_10082.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1026.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1047.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1140.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1141.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1142.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1143.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1144.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1145.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1146.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1147.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1148.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1149.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1250.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1251.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1252.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1253.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1254.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1255.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1256.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1257.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1258.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_1361.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20000.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20001.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20002.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20003.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20004.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20005.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20105.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20106.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20107.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20108.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20127.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20261.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20269.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20273.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20277.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20278.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20280.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20284.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20285.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20290.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20297.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20420.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20423.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20424.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20833.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20838.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20866.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20871.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20880.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20905.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20924.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20932.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20936.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_20949.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_21025.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_21027.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_21866.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_28591.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_28592.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_28593.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_28594.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_28595.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_28596.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_28597.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_28598.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_28599.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\c_28603.nls","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_28605.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_437.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_500.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_708.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_720.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_737.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_775.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_850.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_852.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_855.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_857.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_858.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_860.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_861.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_862.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_863.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_864.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_865.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_866.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_869.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_870.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_874.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_875.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_932.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_936.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_949.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_950.NLS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_G18030.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_IS2022.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\C_ISCII.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d2d1.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3d10.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3d10core.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3d10level9.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3d10warp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3d10_1.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3d10_1core.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3d11.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3d8.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3d8thk.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3d9.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3dim.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3dim700.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3dramp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\d3dxof.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dataclen.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\davclnt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\davhlpr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dbgeng.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dbghelp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dbnetlib.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dbnmpntw.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dccw.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dciman32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dcomcnfg.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DDACLSys.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DDEML.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ddodiag.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DDOIProxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DDORes.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ddraw.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ddrawex.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\debug.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\defaultlocationcpl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Defrag.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\defragproxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\defragsvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\desk.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\deskadp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\deskmon.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\deskperf.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\devenum.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DeviceCenter.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DeviceDisplayObjectProvider.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DeviceDisplayStatusManager.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DeviceEject.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DeviceMetadataParsers.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DevicePairing.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DevicePairingFolder.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DevicePairingHandler.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DevicePairingProxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DevicePairingWizard.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DeviceProperties.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DeviceUxRes.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\devmgmt.msc","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\devmgr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\devobj.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\devrtl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dfdts.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DFDWiz.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dfrgui.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dfscli.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dfshim.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DfsShlEx.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dhcpcmonitor.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dhcpcore.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dhcpcore6.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dhcpcsvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dhcpcsvc6.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DHCPQEC.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dhcpsapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DiagCpl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\diagperf.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dialer.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\diantz.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\difxapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dimsjob.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dimsroam.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dinotify.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dinput.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dinput8.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\diskcomp.com","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\diskcopy.com","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\diskcopy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\diskmgmt.msc","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\diskpart.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\diskperf.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\diskraid.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Dism.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dispci.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dispdiag.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dispex.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Display.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DisplaySwitch.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\djoin.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dllhst3g.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmband.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmcompos.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmdlgs.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmdskmgr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmdskres.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmdskres2.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmime.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmintf.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmloader.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmocx.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmrc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmscript.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmstyle.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmsynth.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmusic.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmutil.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmvdsitf.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dmview.ocx","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dnsapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dnscacheugc.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dnscmmc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dnsext.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dnshc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dnsrslvr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\docprop.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DocumentPerformanceEvents.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\doskey.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dosx.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dot3api.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dot3cfg.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dot3dlg.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dot3gpclnt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dot3gpui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dot3hc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dot3msm.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dot3svc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dot3ui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpapimig.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpapiprovider.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DpiScaling.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dplaysvr.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dplayx.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpmodemx.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpnaddr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpnathlp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpnet.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpnhpast.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpnhupnp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpnlobby.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpnsvr.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dps.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpwsockx.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dpx.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\driverquery.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drmmgrtn.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drmv2clt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drprov.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drtprov.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drttransport.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drvinst.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drvstore.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DRWATSON.EXE","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ds16gt.dLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ds32gt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dsauth.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dsdmo.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DShowRdpFilter.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dskquota.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dskquoui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dsound.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dsprop.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dsquery.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dsrole.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dssec.dat","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dssec.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dssenh.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dsuiext.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dswave.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dtsh.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dui70.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\duser.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dvdplay.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dvdupgrd.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dwm.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dwmapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dwmcore.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dwmredir.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DWrite.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DWWIN.EXE","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dxdiag.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dxdiagn.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dxgi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dxmasf.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DXP.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dxpps.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Dxpserver.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DXPTaskRingtone.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\DxpTaskSync.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dxtmsft.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dxtrans.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\dxva2.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Eap3Host.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eapp3hst.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eappcfg.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eappgnui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eapphost.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eappprxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\EAPQEC.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eapsvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\edit.com","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\EDIT.HLP","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\edlin.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\efsadu.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\efscore.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\efslsaext.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\efssvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\efsui.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\efsutil.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ega.cpi","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\EhStorAPI.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\EhStorAuthn.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\EhStorPwdMgr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\EhStorShell.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\els.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ELSCore.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\elslad.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\elsTrans.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\encapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\EncDec.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\EncDump.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\energy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eqossnap.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\es.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\esent.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\esentprf.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\esentutl.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\esrb.rs","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eudcedit.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\EULA.Microsoft.Application.Verifier.rtf","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eventcls.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eventcreate.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\EventViewer_EventDetails.xsl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eventvwr.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\eventvwr.msc","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\evr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\exe2bin.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\expand.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ExplorerFrame.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\expsrv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\extrac32.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\f3ahvoas.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fastopen.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Faultrep.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fc.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdBth.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdBthProxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fde.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdeploy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdPHost.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdPnp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdprint.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdProxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FDResPub.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdSSDP.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdWCN.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdWNet.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fdWSD.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\feclient.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\filemgmt.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\find.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\findnetprinters.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\findstr.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\finger.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Firewall.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FirewallAPI.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FirewallControlPanel.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fixmapi.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FlashPlayerApp.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FlashPlayerCPLApp.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fltLib.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fltMC.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FM20.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FM20DEU.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FM20ENU.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fmifs.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fms.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FNTCACHE.DAT","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FntCache.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fontext.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fontsub.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fontview.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\forfiles.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\format.com","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fphc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\framebuf.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\framedyn.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\framedynos.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fsmgmt.msc","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fsutil.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fthsvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ftp.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fundisc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fveapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fveapibase.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fvecerts.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fvenotify.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fveprompt.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fveRecover.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fveui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\fwcfg.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FWPUCLNT.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FwRemoteSvr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSAPI.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSCOM.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSCOMEX.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSCOMPOSE.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSCOMPOSERES.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSCOVER.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSEVENT.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSEXT32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSMON.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSRESM.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSROUTE.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSST.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSSVC.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXST30.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSTIFF.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSUNATD.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSUTILITY.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\FXSXP32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\g711codc.ax","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gacinstall.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gameux.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\GameUXLegacyGDFs.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gatherNetworkInfo.vbs","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gb2312.uce","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gcdef.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\GDI.EXE","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gdi32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\getmac.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\GettingStarted.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\getuname.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\glmf32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\glu32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gpapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gpedit.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gpprnext.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gpresult.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gpsvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gptext.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\gpupdate.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\graftabl.com","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\GRAPHICS.COM","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\graphics.pro","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\grb.rs","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Groupinghc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\grpconv.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hal.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\halacpi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\halmacpi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hbaapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hcproviders.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hdwwiz.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hdwwiz.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\help.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\HelpPaneProxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hgcpl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hgprint.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hhctrl.ocx","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hhsetup.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hid.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hidphone.tsp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hidserv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\HIMEM.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hlink.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hnetcfg.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hnetmon.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\HOSTNAME.EXE","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hotplug.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\HotStartUserAgent.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\html.iec","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\httpapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\htui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hwrcomp.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\hwrreg.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iac25_32.ax","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ias.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iasacct.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iasads.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iasdatastore.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iashlpr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IasMigPlugin.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iasnap.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iaspolcy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iasrad.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iasrecst.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iassam.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iassdo.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iassvcs.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icaapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icacls.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icardagt.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icardie.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icardres.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iccvid.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icfupgd.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icm32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icmp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icmui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IconCodecService.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icrav03.rat","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icsigd.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\icsunattend.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ideograf.uce","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IdListen.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\idndl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IDStore.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ie4uinit.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ieakeng.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ieaksie.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ieakui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ieapfltr.dat","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ieapfltr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iedkcs32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iepeers.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iernonce.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iertutil.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iesetup.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iesysprep.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ieui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ieuinit.inf","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ieUnatt.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iexpress.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ifmon.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ifsutil.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ifsutilx.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\igdDiag.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IKEEXT.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\imaadp32.acm","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\imagehlp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\imagesp1.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\imapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\imapi2.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\imapi2fs.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\imgutil.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IMJP10.IME","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IMJP10K.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\imkr80.ime","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\imm32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\inetcomm.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\inetcpl.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\inetmib1.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\inetpp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\inetppui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\INETRES.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\InfDefaultInstall.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\infocardapi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\infocardcpl.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\InkEd.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\input.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\inseng.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\InstallPackage_ETW.Log","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\intl.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iologmsg.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IPBusEnum.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IPBusEnumProxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ipconfig.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IPHLPAPI.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iphlpsvc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ipnathlp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iprop.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iprtprio.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iprtrmgr.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ipsecsnp.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\IPSECSVC.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ipsmsnap.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ir32_32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ir41_32.ax","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ir41_qc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ir41_qcx.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ir50_32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ir50_qc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ir50_qcx.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\irclass.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\irftp.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\irmon.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\irprops.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iscsicli.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iscsicpl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iscsicpl.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iscsidsc.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iscsied.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iscsiexe.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iscsilog.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iscsium.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iscsiwmi.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\isoburn.exe","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\itircl.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\itss.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iTVData.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\ivfsrc.ax","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\iyuv_32.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\jnwmon.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\joy.cpl","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\jscript.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\jsproxy.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\kanji_1.uce","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\kanji_2.uce","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KB16.COM","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KB896559.TXT","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\kbd101.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\kbd101a.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\kbd101b.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\kbd101c.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\kbd103.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\kbd106.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\kbd106n.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDA1.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDA2.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDA3.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDAL.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDARME.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDARMW.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\kbdax2.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDAZE.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDAZEL.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDBASH.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDBE.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDBENE.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDBGPH.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDBGPH1.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDBHC.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDBLR.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDBR.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDBU.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDBULG.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDCA.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDCAN.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDCR.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDCZ.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDCZ1.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDCZ2.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDDA.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDDIV1.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDDIV2.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDDV.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDES.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDEST.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDFA.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDFC.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDFI.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\KBDFI1.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\1394bus.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\1394ohci.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\acpi.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\acpipmi.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\adp94xx.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\adpahci.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\adpu320.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\afd.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\agilevpn.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\AGP440.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\aliide.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\AMDAGP.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\amdide.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\amdk8.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\amdppm.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\amdsata.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\amdsbs.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\amdxata.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\appid.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\arc.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\arcsas.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\asyncmac.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\atapi.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ataport.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\b57nd60x.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\battc.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\BazisVirtualCDBus.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\beep.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\blbdrive.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\bowser.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\BrFiltLo.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\BrFiltUp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\bridge.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\BrSerId.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\BrSerWdm.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\BrUsbMdm.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\BrUsbSer.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\bthmodem.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\bxvbdx.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\cdfs.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\cdrom.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\circlass.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\Classpnp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\CmBatt.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\cmdide.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\cng.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\compbatt.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\CompositeBus.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\crashdmp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\crcdisk.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\dfsc.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\discache.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\disk.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\Diskdump.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\djsvs.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\drmk.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\drmkaud.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\Dumpata.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\dumpfve.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\dxapi.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\dxg.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\dxgkrnl.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\dxgmms1.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\E1G60I32.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\elxstor.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\errdev.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\evbdx.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\exfat.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\fastfat.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\fdc.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\fileinfo.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\filetrace.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\flpydisk.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\fltMgr.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\fsdepends.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\fs_rec.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\fvevol.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\FWPKCLNT.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\GAGP30KX.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\gm.dls","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\gmreadme.txt","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\hcw85cir.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\hdaudbus.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\HdAudio.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\hidbatt.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\hidbth.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\hidclass.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\hidir.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\hidparse.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\hidusb.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\HpSAMD.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\http.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\hwpolicy.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\i8042prt.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\iaStorV.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\iirsp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\intelide.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\intelppm.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ipfltdrv.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\IPMIDrv.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ipnat.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\irda.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\irenum.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\isapnp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\kbdclass.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\kbdhid.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ks.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ksecdd.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ksecpkg.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\lltdio.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\lsi_fc.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\lsi_sas.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\lsi_sas2.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\lsi_scsi.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\luafv.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mcd.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\megasas.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\MegaSR.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\modem.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\monitor.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mouclass.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mouhid.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mountmgr.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mpio.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mpsdrv.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mrxdav.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mrxsmb.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mrxsmb10.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mrxsmb20.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\msahci.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\msdsm.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\msfs.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\MsftWdf_Kernel_01009_Inbox_Critical.Wdf","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mshidkmdf.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\msisadrv.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\msiscsi.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mskssrv.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mspclock.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mspqm.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\msrpc.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mssmbios.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mstee.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\MTConfig.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\mup.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ndis.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ndiscap.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ndistapi.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ndisuio.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ndiswan.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ndproxy.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\netbios.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\netbt.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\netio.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\nfrd960.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\npf.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\npfs.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\nsiproxy.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ntfs.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\null.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\nvraid.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\nvstor.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\NV_AGP.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\nwifi.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ohci1394.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\pacer.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\parport.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\partmgr.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\parvdm.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\pci.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\pciide.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\pciidex.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\pcmcia.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\pcw.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\PEAuth.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\portcls.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\processr.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ql2300.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ql40xx.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\qwavedrv.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\rasacd.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\rasl2tp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\raspppoe.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\raspptp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\rassstp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\rdbss.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\rdpbus.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\RDPCDD.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\RDPENCDD.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\RDPREFMP.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\rdpwd.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\rdyboost.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\rmcast.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\RNDISMP.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\rootmdm.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\rspndr.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\sbp2port.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\scfilter.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\scsiport.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\secdrv.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\serenum.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\serial.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\sermouse.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\sffdisk.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\sffp_mmc.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\sffp_sd.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\sfloppy.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\SISAGP.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\sisraid2.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\sisraid4.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\smb.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\smclib.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\spldr.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\spsys.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\srv.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\srv2.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\srvnet.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\stexstor.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\storport.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\stream.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\swenum.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\tape.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\tcpip.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\tcpipreg.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\tdi.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\tdpipe.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\tdtcp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\tdx.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\termdd.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\tssecsrv.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\TsUsbFlt.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\TsUsbGD.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\tunnel.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\UAGP35.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\udfs.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ULIAGPKX.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\umbus.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\umpass.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usb8023.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\USBCAMD.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\USBCAMD2.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usbccgp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usbcir.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usbd.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usbehci.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usbhub.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usbohci.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usbport.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usbprint.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usbrpm.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\USBSTOR.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\usbuhci.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\VBoxGuest.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\VBoxMouse.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\VBoxSF.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\VBoxVideo.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\vdrvroot.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\vga.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\vgapnp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\vhdmp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\VIAAGP.SYS","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\viac7.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\viaide.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\videoprt.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\volmgr.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\volmgrx.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\volsnap.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\vsmraid.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\vwifibus.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\vwififlt.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\vwifimp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\wacompen.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\wanarp.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\watchdog.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\wd.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\Wdf01000.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\WdfLdr.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\wfplwf.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\wimmount.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\wmiacpi.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\wmilib.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\ws2ifsl.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\WUDFPf.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\drivers\\WUDFRd.sys","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\Tasks\\CCleanerSkipUAC","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\D50.camp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\D65.camp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\Graphics.gmmp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\MediaSim.gmmp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\Photo.gmmp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\Proofing.gmmp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\RSWOP.icm","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\wscRGB.cdmp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\wsRGB.cdmp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\FXSAPI.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\FXSDRV.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\FXSRES.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\FXSTIFF.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\FXSUI.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\FXSWZRD.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\JNWDRV.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\jnwdui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\mxdwdrv.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\mxdwdui.BUD","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\mxdwdui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\mxdwdui.gpd","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\mxdwdui.ini","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\STDDTYPE.GDL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\STDNAMES.GPD","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\STDSCHEM.GDL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\STDSCHMX.GDL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\UNIDRV.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\unidrv.hlp","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\unidrvui.dll","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\UNIRES.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\XPSSVCS.DLL","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\PCC\\ntprint.inf_x86_neutral_88459cb66b0e2d44.cab","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\PCC\\prnms001.inf_x86_neutral_a1ff1bc29207b04f.cab","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\PCC\\prnms002.inf_x86_neutral_36c16a14ad707821.cab","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\PCC\\prnms002.inf_x86_neutral_baa1493e6380688b.cab","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\LUUO\\","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"},{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Global\\{D080400C-CD0B-04E7-29E4-C841B4066644}","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"name":"Global\\{B8236F38-ADBC-2C58-E5F4-592A77F8381F}","sources":[{"report_type":"sandbox","report_id":"565c312a0e316d5967b483a3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{DF5CCDA5-FC6E-BD12-0B8B-F11AEFB640B7}","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{A6796722-E2AC-1221-CFF8-E9D16E2443CF}","sources":[{"report_type":"sandbox","report_id":"565c5e140e316d2103745917"}]}]}},"report_ids":{"sandbox_job_ids":["565c5e140e316d2103745917","565c312a0e316d5967b483a3","565c44610e316d5958e6367c"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious TROJ_KOVTER.SMVB Sample d6dfe0521d13… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d6dfe0521d13…. Malware family: TROJ_KOVTER.SMVB. Threat score 100/100. 22/28 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d6dfe0521d13b069864b93d77a5465706f1544fd78b5c6bd556fa37d7ca0a7b0"}],["$","meta","4",{"property":"og:title","content":"Malicious TROJ_KOVTER.SMVB Sample d6dfe0521d13… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d6dfe0521d13…. Malware family: TROJ_KOVTER.SMVB. Threat score 100/100. 22/28 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d6dfe0521d13b069864b93d77a5465706f1544fd78b5c6bd556fa37d7ca0a7b0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TROJ_KOVTER.SMVB Sample d6dfe0521d13… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d6dfe0521d13…. Malware family: TROJ_KOVTER.SMVB. Threat score 100/100. 22/28 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]