26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4c3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Fragtor.Generic Sample eb00e3c45cb6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample eb00e3c45cb6…. Malware family: Fragtor.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138","keywords":["Malicious","Fragtor.Generic","malware analysis","sandbox report","threat intelligence","eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138"],"about":{"@type":"SoftwareApplication","name":"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138.exe","applicationCategory":["neexe","executable"],"identifier":"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Fragtor.Generic","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5da,".exe" queries volume information of "C:\" at 00008258-00000740-00000046-14417379725 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-18711972539 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-21838190019 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-26673940654 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-28632067161 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-44913286920 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-45010746867 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-45180840662 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-45371412455 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-49944144291 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-55872179594 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-58862426854 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-59890697212 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-63729585344 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-6406171339628:T5da,".exe" queries volume information of "C:\" at 00008258-00000740-00000046-14417379725 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-18711972539 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-21838190019 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-26673940654 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-28632067161 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-44913286920 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-45010746867 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-45180840662 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-45371412455 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-49944144291 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-55872179594 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-58862426854 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-59890697212 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-63729585344 ".exe" queries volume information of "C:\" at 00008258-00000740-00000046-6406171339629:T441,".exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") ".exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") ".exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") ".exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") ".exe" touched "Recent Places Folder" (Path: "HKCU\WOW6432NODE\CLSID\{22877A6D-37A1-461A-91B0-DBDA5AAEBC99}\SHELLFOLDER")2a:T5b8,".exe" queried SystemProcessInformation at 00008258-00000740-00000033-31418944881 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-58008526714 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-75889493837 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-87072728192 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-112501043280 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-126499973110 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-152225915075 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-171971701143 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-192795770418 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-213755426475 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-234889663670 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-255276948612 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-276075542505 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-296757063859 ".exe" queried SystemProcessInformation at 00008258-00000740-00000033-3177983301012b:T786,"Hello, dear friend! ================================================= 1- [All your files have been ENCRYPTED!] Your files are NOT damaged! Your files are modified only. The only way to decrypt your files is to receive the decryption program. your files can not be decrypted without the special program we made it for your computer. ================================================= 2- [ HOW TO RETURN FILES? ] To receive the decryption program Write to our email "BigBobRoss@protonmail.com" and tell us your unique ID ================================================= 3- [ FREE DECRYPTION! ] Free decryption as guarantee. We guarantee the receipt of the decryption program after payment. To believe, you can give us 1 file that must be less than 1MB and we decrypt it for free. File should not be important to you! databases, backups, large excel sheets, etc. ================================================= 4- [ Instruction ] the easiest way to buy bitcoins is LocalBitcoins site. you have to register, click "buy bitcoins" and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins ================================================= CAUTION! please do not change the name of files or file extension if your files are important to you!385FF103" (Source: Read Me.txt, Indicator: "decrypt your files") "1- [All your files have been ENCRYPTED!]" (Source: Read Me.txt, Indicator: "files have been encrypted") "The only way to decrypt your files is to receive the decryption program." (Source: Read Me.txt, Indicator: "decrypt your files") "Hello, dear friend! ================================================= 1- [All your files have been ENCRYPTED!] Your files are NOT damaged! Your files are modified only. The only way to decrypt your files is to receive the decryption program. your file" (Source: 00008258-00000740-00000005-58870888582, Indicator: "decrypt your files")2c:T78b,".exe" opened "C:\Users\%OSUSER%\Contacts\%OSUSER%.contact" with delete access ".exe" opened "C:\Users\%OSUSER%\Documents\Database1.accdb" with delete access ".exe" opened "C:\Users\%OSUSER%\Documents\Outlook Files\Outlook.pst" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\17kuxun.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\360.cn.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\17173.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\39.net.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\3366.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\51.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\360buy.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\58.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\4399.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\6.cn.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\51wan.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\726.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\5pk.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\61.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\7k7k.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\96pk.com.url" with delete access ".exe" opened "C:\Users\%OSUSER%\Favorites\Links\about.com.url" with delete access2d:T62c,Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00026817-00002880) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00027827-00004016) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00028827-00003404) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00029819-00002868) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00030819-00003064) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00031821-00002712) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00032836-00003568) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00033815-00003584) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00034814-00003880) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00035813-00002092) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00036819-00003316) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00037813-00000468) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00038812-00004060) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00039825-00002720)2e:T62c,Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00026817-00002880) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00027827-00004016) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00028827-00003404) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00029819-00002868) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00030819-00003064) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00031821-00002712) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00032836-00003568) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00033815-00003584) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00034814-00003880) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00035813-00002092) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00036819-00003316) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00037813-00000468) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00038812-00004060) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00039825-00002720)2f:T75a,".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 532) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 532) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 532) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 480) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 480) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 480) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 216) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 216) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 216) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 236) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 236) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 236) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 196) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 196) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 196) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 276) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 276) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 276)30:T66b,Spawned process ".exe" (UID: 00025444-00003280) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00026817-00002880) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00027827-00004016) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00028827-00003404) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00029819-00002868) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00030819-00003064) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00031821-00002712) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00032836-00003568) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00033815-00003584) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00034814-00003880) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00035813-00002092) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00036819-00003316) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00037813-00000468) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00038812-00004060) Spawned process "notepad.exe" with commandline "C:/Users/%OSUSER%/Desktop/Read Me.txt" (UID: 00039825-00002720)31:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790445243678,"unified_at":"2026-09-26T17:54:03.678Z","metadata":{"hashes":{"sha256":"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138","sha1":"ef68f39b5908b8405ce55a51d6e3c599839c3cbb","md5":"e49d70b619a1220ebb880dc4f19f730c","sha512":"3f7bce6721248a42952353c5ff8bed36505dfccb27d7b148e63b68158389117d328002701fcd9765991a07565972c88d3bfaa7d598f7e9ff8a339845656865a0","ssdeep":"24576:5WB+erw3XXWVrbttf9opnZDkH6UZEzvzDv0RnxvDa:5Xe0HGhtncnRkH6TDv0RnJ","ssdeep_chunks":["24576:5WB+erw","24576:WB+erw3","24576:B+erw3X","24576:+erw3XX","24576:erw3XXW","24576:rw3XXWV","24576:w3XXWVr","24576:3XXWVrb","24576:XXWVrbt","24576:XWVrbtt","24576:WVrbttf","24576:Vrbttf9","24576:rbttf9o","24576:bttf9op","24576:ttf9opn","24576:tf9opnZ","24576:f9opnZD","24576:9opnZDk","24576:opnZDkH","24576:pnZDkH6","24576:nZDkH6U","24576:ZDkH6UZ","24576:DkH6UZE","24576:kH6UZEz","24576:H6UZEzv","24576:6UZEzvz","24576:UZEzvzD","24576:ZEzvzDv","24576:EzvzDv0","24576:zvzDv0R","24576:vzDv0Rn","24576:zDv0Rnx","24576:Dv0Rnxv","24576:v0RnxvD","24576:0RnxvDa","49152:5WB+erw","49152:WB+erw3","49152:B+erw3X","49152:+erw3XX","49152:erw3XXW","49152:rw3XXWV","49152:w3XXWVr","49152:3XXWVrb","49152:XXWVrbt","49152:XWVrbtt","49152:WVrbttf","49152:Vrbttf9","49152:rbttf9o","49152:bttf9op","49152:ttf9opn","49152:tf9opnZ","49152:f9opnZD","49152:9opnZDk","49152:opnZDkH","49152:pnZDkH6","49152:nZDkH6U","49152:ZDkH6UZ","49152:DkH6UZE","49152:kH6UZEz","49152:H6UZEzv","49152:6UZEzvz","49152:UZEzvzD","49152:ZEzvzDv","49152:EzvzDv0","49152:zvzDv0R","49152:vzDv0Rn","49152:zDv0Rnx","49152:Dv0Rnxv","49152:v0RnxvD","49152:0RnxvDa","24576:5Xe0HGh","24576:Xe0HGht","24576:e0HGhtn","24576:0HGhtnc","24576:HGhtncn","24576:GhtncnR","24576:htncnRk","24576:tncnRkH","24576:ncnRkH6","24576:cnRkH6T","24576:nRkH6TD","24576:RkH6TDv","24576:kH6TDv0","24576:H6TDv0R","24576:6TDv0Rn","24576:TDv0RnJ"],"imphash":"1c1a5539627991c404d29ff74ae5b559"},"file_info":{"file_name":"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138.exe","file_type":["neexe","executable"],"file_type_id":"dos","file_size":967168,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1548069251000,"last_seen":1677400122000,"last_multi_scan":1677400122000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":13,"suspicious_count":14,"malicious_count":5,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fragtor.9053","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Fragtor.9053 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.NUB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005459d51 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Encoder.bhn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.fmcwqt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Wacatac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder.Win32.549","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Fragtor.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"$28","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$29","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"bestbuy.com.url\" has type \"data\"\n \"pagesjaunes.fr.url\" has type \"data\"\n \"bankofamerica.com.url\" has type \"data\"\n \"qunar.com.url\" has type \"data\"\n \"MSN Money.url\" has type \"Dyalog APL version 52.39\"\n \"cnn.com.url\" has type \"data\"\n \"linkedin.com.url\" has type \"data\"\n \"homedepot.com.url\" has type \"data\"\n \"y8.com.url\" has type \"data\"\n \"typepad.com.url\" has type \"data\"\n \"wikimedia.org.url\" has type \"data\"\n \"torrentz.eu.url\" has type \"data\"\n \"zynga.com.url\" has type \"data\"\n \"Read Me.txt\" has type \"ASCII text with CRLF line terminators\"\n \"cyworld.com.url\" has type \"data\"\n \"zhenai.com.url\" has type \"data\"\n \"ebay.co.uk.url\" has type \"data\"\n \"Tulips.jpg\" has type \"data\"\n \"tmall.com.url\" has type \"data\"\n \"mozilla.com.url\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"\n \".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db\"\n \".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\shdocvw.dll\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"}c.Bz\"\n Pattern match: \"https://localbitcoins.com/buy_bitcoins\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138.bin\" was detected as \"MPRESS v2.00-V2.0X -> MATCODE Software * 20090423\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".MPRESS1 with unusual entropies 7.99980912762","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"HAPUBWS.contact\" containing the Windows username \"HAPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Recent\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2b","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2c","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138.bin\" has an entrypoint in section \".MPRESS2\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n GetModuleHandleA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c0dfbb771cf9ba77ccf8ba770d64bc7700000000c011a17600000000fc3ea17600000000e013a176000000009457f07625e0bb77c6e0bb7700000000bc6aef7600000000cf31a176000000009319f076000000002c32a17600000000\" to virtual address \"0x77141000\" (part of module \"NSI.DLL\")\n \".exe\" wrote bytes \"711130017a3b2f01ab8b02007f950200fc8c0200729602006cc805001ecd2c017d262c01\" to virtual address \"0x769107E4\" (part of module \"USER32.DLL\")\n \".exe\" wrote bytes \"4512a1762212a17600000000fb7991760000000076b5f576000000007e4095750000000094b0c076000000005ca6f874000000008a3f6b7500000000a09ea075\" to virtual address \"0x006D40B4\" (part of module \"EB00E3C45CB698E44B087FD4646DA69631AE88BA670D4D1507C7232040B10138.EXE\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/70 Antivirus vendors marked sample as malicious (60% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/15 Antivirus vendors marked sample as malicious (13% detection rate)\n 42/70 Antivirus vendors marked sample as malicious (60% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"2.16.155.11:80\"\n \"2.18.77.109:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2d","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$2e","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"notepad.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"bigbobross@protonmail.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 532)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 480)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 216)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 236)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 196)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\notepad.exe\", Handle: 276)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\".exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 2.16.155.11 on port 80 is sent without HTTP header\n TCP traffic to 2.18.77.109 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%USERPROFILE%\\Read Me.txt\"\n \".exe\" allocated memory in \"%USERPROFILE%\\Favorites\\Links\\355.url\"\n \".exe\" allocated memory in \"\\Device\\NamedPipe\\qt-1EB\"\n \".exe\" allocated memory in \"%USERPROFILE%\\Documents\\Visual Studio 2008\\Templates\"\n \".exe\" allocated memory in \"\\Device\\NamedPipe\\qt-1238\"\n \".exe\" allocated memory in \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{8177f4e5-b53f-11e4-a9c2-806e6f6e6963}\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$30","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]}]},"activity":{"stats":{"process_count":15,"spawned_processes_count":15,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":46,"dropped_files_count":0,"extracted_files_count":54,"files_written_count":642,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files","Sample not shared","TOR analysis","Network Traffic"],"sandbox_reports":[{"id":"5c45a7b17ca3e1052e28463f","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Trojan.Heur.RP","submit_name":"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138.exe","analysis_start_time":"2019-01-21T12:25:16+00:00","indicators_count":{"informative":9,"suspicious":14,"malicious":3},"tags":["Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true},{"id":"5c45a7b07ca3e1052c2d875b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Trojan.Heur.RP","contacted_countries":["EU"],"submit_name":"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138.exe","analysis_start_time":"2019-01-21T12:17:39+00:00","indicators_count":{"informative":13,"suspicious":16,"malicious":6},"tags":["Network Traffic","Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"2.16.155.11","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"address":"2.18.77.109","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}],"processes":[{"pid":3280,"ppid":0,"name":"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138.exe","command_line":"","sha256":"eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138","normalized_path":"C:\\eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138.exe","uid":"00025444-00003280","icon":"$31"},{"pid":2880,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00026817-00002880"},{"pid":4016,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00027827-00004016"},{"pid":3404,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00028827-00003404"},{"pid":2868,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00029819-00002868"},{"pid":3064,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00030819-00003064"},{"pid":2712,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00031821-00002712"},{"pid":3568,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00032836-00003568"},{"pid":3584,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00033815-00003584"},{"pid":3880,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00034814-00003880"},{"pid":2092,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00035813-00002092"},{"pid":3316,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00036819-00003316"},{"pid":468,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00037813-00000468"},{"pid":4060,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00038812-00004060"},{"pid":2720,"ppid":3280,"name":"notepad.exe","command_line":"C:/Users/%OSUSER%/Desktop/Read Me.txt","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00025444-00003280","uid":"00039825-00002720"}],"all_imported_dlls":["ws2_32.dll","apphelp.dll","shdocvw.dll","sechost.dll","sspicli.dll","oleaut32.dll","shlwapi.dll","wow64cpu.dll","kernel32.dll","lpk.dll","advapi32.dll","rpcrt4.dll","imm32.dll","linkinfo.dll","user32.dll","KernelBase.dll","nsi.dll","ntmarta.dll","wow64win.dll","shell32.dll","cfgmgr32.dll","devobj.dll","ntdll.dll","profapi.dll","msvcrt.dll","msctf.dll","clbcatq.dll","uxtheme.dll","userenv.dll","cryptbase.dll","ole32.dll","comctl32.dll","propsys.dll","Wldap32.dll","gdi32.dll","usp10.dll","winmm.dll","api-ms-win-core-synch-l1-2-0.dll","setupapi.dll","wow64.dll","dwmapi.dll","rpcss.dll","IconCodecService.dll","comdlg32.dll","WindowsCodecs.dll","version.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Read Me.txt","sha256":"dfd2c33850c8195b960ce91bb0e69f573eba6340f12b19bf7a785469142cafc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"Maid with the Flaxen Hair.mp3","sha256":"1dc615200463de7de1dc6a69f023992e88efea5ac0d00ec334f13bba8069c514","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"Sleep Away.mp3","sha256":"fb50c12fef34376044c48f4d4f838461f9a76e9397e04c299f61ae163a81805c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"Chrysanthemum.jpg","sha256":"c39506c7d414ae966e24a75f7e8a69861111b189a052e6d6e7d348a0ca526021","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"Desert.jpg","sha256":"1e0a632ef5221c7457f2c824e7e6817594acd37b98ea583bdab8cb214494188a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"Hydrangeas.jpg","sha256":"b7b4a1d8dbb5ce86e4936695365d6997cf375dbf6aad7a663b6d1afccdff3c9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"Jellyfish.jpg","sha256":"f08daadd6bd5ebac5aacb80d289aef9087eef3785969680d4e172d12d772763c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"Koala.jpg","sha256":"5784a2953c1f6063fb0b07c944c3b196128f3d16105e0d418b752427841a17e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"Lighthouse.jpg","sha256":"fc2f5faa55f72c2683cb59a2af3cc2dee0576511e7de85859feb7ad7db549513","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"Penguins.jpg","sha256":"087f8555a33c0af89d48f5e0f64fca6cd8be39559113b1cd3035fc11161ba5f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"Tulips.jpg","sha256":"0680014ad1b2d28a632d7c2caba30dff07257a87dc2c44d2d9f5c28cde32f8bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"HAPUBWS.contact","sha256":"1c208a5ea6550dda588efd9869e60122bb52db2fd9cb8a443ce0d800b6d05dda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"Database1.accdb","sha256":"75d03c354b694c186b1aa223b142f8b45eec1503beeb4e14813035686b701a1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"Outlook.pst","sha256":"513b09f80c667c045cdd34e3f89be68b7fb37b68ac225efce22b8a952fedd4ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"GobiernoUSA.gov.url","sha256":"032614f1bc1733accb3ee5d59a338d0fdc4f3030acc070f8b2d59bf0d9298b76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"USA.gov.url","sha256":"5600ca37a9defa153a100e892c68e6b062920dc78ba9ce2577d76c6bb7012ac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"1616.net.url","sha256":"da21bf2e76ab15be03dadad7c50c2b3377e85395f19de318ca5556c98df69727","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"17173.com.url","sha256":"221615102e3c095c9c3c40c024e45ecd98ed6416527f5eedaafad41f6a781e83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"17kuxun.com.url","sha256":"a446c5f84881b7084abb1e82f94ac4d3671bdad0e4b2adfc31181e6e016ebafa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"3366.com.url","sha256":"d5eff1b54df87afaf5b58e60a395c8977f5c5056cbadb7b839ff40e2eeed1dda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"name":"PSPUBWS.contact","sha256":"958b0abe9d37d2eab6779d2b589fc7b53dccd1cebd00fc81c5a69fa2009e097d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"01dMtnkBz9.gif","sha256":"09bd9323038a673e85e8a48ba6804c2b6e8626cc395aaff13be82d7b36b6cdb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"04bZ.txt","sha256":"e02e41a5e638b693954f834a7ca1e8ac88bc23b63761a1f330e57d259d33aa79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"0Og1.rar","sha256":"58e0d85c51e74c15c465f44658bf7a61bbb094b1df69bb4d29707273b96b5362","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"a13736b297a85b33be66b9eccdb9d6a7fb9c57bf6fa32822ec69c469e4e631c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"1aa1094c63e5295d476778accd5d8239de790957aff71eb49d4f1291e44b3da4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"0zIG0D.doc","sha256":"cb0b3dd09e96e39729280a5d133d9e05f5fadf22c74046140e7ad88227866909","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"fee6995f602ece6464166c31d6c68f7e558852f802118c66eb0caf7ae696235e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"2f2324c0976bb0c1c85f8c70e832767da32bedf815223b3f3790fa660d504382","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"6SZfLTu9z.doc","sha256":"866070ad6978955f6126be8f1a82b64b48f81655bbc90ac023a0725c48dc4e49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"8df3102e20f0edbb37eac561724c0c6e3eddf19a3ef43bb767d33782d337937b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"a13f1dbca4d1b4083fa7880236c71c72f2bbb6db6431c99f9bc493c8af76a270","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"C04T72pR0Bcl.doc","sha256":"44d899f57173c72292fba122a0a1ff2672f24f9f47a8401187cd9a312f408d6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"EKeaJO.doc","sha256":"04621e4d79464f01e2428945ac56ee7e120ffb283bd4b254e229dd8182ec04aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"F3hzum1.doc","sha256":"c755058793d3804ccd716b49953b6391b61b4b474bf19ee91ba561d2b7c81cdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"c69be7a47db7f721fe82c929ef5462bb1982505cbec9000df835907a77cdbb3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"a3Ntx.exe","sha256":"381772795df0f7aa88f1a79b56b5e503f75873efe19c8ac375401dd6759683da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"bg3oTe.doc","sha256":"d04f0a1fe74d2893feb8552e11e0984862411ed0503ab9f3e43acadced7452c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"bvYkKJ33N9A.exe","sha256":"622223a2268a47313f419ed464e275ebc3a317bc3b3bbaf4a81d0e91fdc9950f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"dH1rDN9f9.doc","sha256":"e7e4e022a0b96cb73eca325fee0356ef6cc6bf82798fd2b4c3ee979befb1fc39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"dgQJde60mPXhI.exe","sha256":"3b81e26b7ba66a9ba0cc20036eaaefb44228794030d4d3ebb3fb9913a00d82e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"dskCEJ.exe","sha256":"a997a911b7c33cd0a044b546253b81e38d46622c1450b2dd10b0c8da4678b015","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"hKY8.doc","sha256":"7b66376e4c823204bccdfa80ddffafec55e98732447960c17dac61cedd0e4759","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"hlchPBL.exe","sha256":"096d9b2ab3a26c468deaf6fe1509e9bfa9e6f06f18036a1e692ab23e00462889","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"iLLOga.exe","sha256":"17e46ea7669d83f8285529f28adbe72cce78451e37d9d0cc1041530d88fff192","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"kY01UeAiy5.exe","sha256":"574f5bf402af57192dfb89da82cd8d61d3152db59d006e65d36e530e4a5aa595","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"eaf30c9c715d5083f32217ecc19fda824c6f402b34e1793127061551a0901b13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"klmqz.doc","sha256":"cfd23cd276c394a94f6973c9f92cdf893c43a1af81db63bd36d173a8abee76bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"197fc1f21d135c326bb88312d48120970dfd3b39a1adfe15fa027c429cf4dbc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"mtgFs8Za.doc","sha256":"97b365abd2bad596dcc47ee3827bce2b4275c153f765941d43f2ead358f7f676","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"rRgk91Ih5n.doc","sha256":"a238a1e0fef07a5d1b0228dfb3cd26e36a9f2c587d6a215c805d33345b1bef76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"tDUzYwYK5f.exe","sha256":"4f98af00b771c72a75e984de866b4f1f1a2fb5e29dbccd93339eb5d4f11f267e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"w5JaoO.doc","sha256":"5ed8bb8ce9624e3477d3d1ae03e9b057e340b3f320b59c194451a10e69b35a3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"ce7f6b2a6806d226904744676a34cd3d64440bf48df8e9c9ab1c712bbdd4080b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]}],"files_written":[{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Contacts\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Documents\\Database1.accdb","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"C:\\Qt\\Qt5.8.0\\5.8\\static\\qtlogging.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Documents\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17173.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Links\\Desktop.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\39.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\3366.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\51.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360buy.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\58.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4399.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\6.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\51wan.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\726.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\61.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\96pk.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\about.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\addictinggames.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\agame.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\95599.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alipay.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abchina.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\accountonline.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\adobe.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alibaba.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\allrecipes.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\allegro.pl.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alot.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.de.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ameba.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\answers.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\aol.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\apple.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\asahi.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\att.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\autohome.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\avast.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\badoo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\babylon.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baidu.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baixaki.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baixing.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bankofamerica.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\biglobe.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bizrate.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogger.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogspot.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\booking.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\brothersoft.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\caixa.gov.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\camzap.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\capitalone.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\careerbuilder.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ccb.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\chase.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\china.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\chinanews.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\clubpenguin.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnet.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnn.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cntv.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cocolog-nifty.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cyworld.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dailymail.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dailymotion.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dangdang.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\daum.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dell.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\depositfiles.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dianping.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\discoverbing.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\docin.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\douban.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\duowan.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1616.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.de.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ehow.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\exblog.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\exoplanetwar.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\expedia.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\facebook.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\facemoods.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fedex.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fileserve.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\filestube.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\flickr.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\foxnews.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\foxsports.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\funshion.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\glispa.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\google.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gougou.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\groupon.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\guardian.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gyyx.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hatena.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hexun.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hi5.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\homedepot.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotels.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotfile.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotmail.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hp.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huanqiu.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huffingtonpost.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hulu.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iciba.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Links\\Downloads.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iegallery.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ifeng.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ig.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imdb.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iminent.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\java.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\jiayuan.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\juegos.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kaixin001.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baomihua.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bbc.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bestbuy.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bitauto.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kakaku.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ku6.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kugou.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\leboncoin.fr.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\letv.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\libero.it.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\linkedin.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\live.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livedoor.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livejournal.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livingsocial.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\lowes.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\macys.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\marketgid.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\match.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mcafee.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\megaupload.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\megavideo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mercadolivre.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\metrolyrics.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsoft.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsofttranslator.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\miniclip.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mlb.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\monster.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\moonbasa.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mop.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.org.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\msn.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\musica.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mylife.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mywebsearch.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\narod.ru.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nate.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\naver.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netflix.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netlog.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nextag.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nhk.or.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nicovideo.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nifty.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nk.pl.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\norton.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nytimes.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ocn.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\odnoklassniki.ru.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\okwave.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\onet.pl.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orange.fr.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orkut.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orkut.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\oyunlar1.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pagesjaunes.fr.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paipai.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partycasino.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\partypoker.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paypal.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pconline.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\people.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\photobucket.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pog.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pogo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\priceline.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qidian.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qq.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qunar.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rapidshare.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\real.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rediff.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\reference.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\renren.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\reuters.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rr.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\samsung.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\scribd.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sears.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\skycn.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\skype.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\slideshare.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\so-net.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sogou.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soku.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soso.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\soufun.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sourceforge.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sponichi.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\surveymonkey.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sweetim.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\syyx.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\szgla.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\t-online.de.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tagged.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\taleo.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\taobao.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\target.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tenpay.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\terra.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\thepiratebay.org.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tianya.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tmall.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\torrentz.eu.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tripadvisor.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tripod.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tudou.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\tumblr.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\twitpic.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\twitter.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\typepad.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ucoz.ru.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\uol.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ups.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\vancl.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verizon.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verizonwireless.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\verycd.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Links\\OneDrive.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\vimeo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\vkontakte.ru.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\walmart.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\weather.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\weather.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\webmd.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wellsfargo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\whitepages.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikia.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikimapia.org.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikimedia.org.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wikipedia.org.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\windows.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wo.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wordpress.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wowan365.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wp.pl.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wushen.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yfrog.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yahoo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\y8.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\xinhuanet.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yandex.ru.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yahoo.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yellowpages.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youku.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youdao.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\youtube.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zedo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zimbio.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\yzz.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zynga.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zhenai.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\zoosk.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\GobiernoUSA.gov.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\USA.gov.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft At Home.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft At Work.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\IE Add-on site.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Autos.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\Microsoft Store.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Entertainment.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Money.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Get Windows Live.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSNBC News.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\MSN Sports.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Mail.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Gallery.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\Windows Live Spaces.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Searches\\Microsoft Outlook.searchconnector-ms","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Searches\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Sleep Away.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Hydrangeas.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Lighthouse.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Koala.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Tulips.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%USERPROFILE%\\Links\\RecentPlaces.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"C:\\share\\1548069928312$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"C:\\share\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\Wildlife.wmv","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Kalimba.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Desert.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Chrysanthemum.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Jellyfish.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"},{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Penguins.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"C:\\share\\1548069928312$OK","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"C:\\share\\eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b17ca3e1052e28463f"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Desktop\\Calculator.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Desktop\\MineSweeper.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Desktop\\Paint.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Desktop\\Sticky Notes.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Desktop\\Windows Media Player.lnk","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Desktop background.png","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\01dMtnkBz9.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\04bZ.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\07Y08HBp.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\0cuxPf1k3pJ5.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\0gakl8ixtWMkw.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\0Og1.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\0pYWspjURe8aqA.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\System32\\notepad.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\0zIG0D.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"C:\\bg.png","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\1N1A3vlRdYRii5C.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\1q4yvQVxByym4.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\2Gd1Iqvl2kr.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\2l36bsgulx.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\3AVoUo9c20GI.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\3Awf.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\3bvjbrQlfgjI.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\3dfFyhzUJVQSk.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\3Fbc.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\4lpro8p6KuJo0.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\4nAn3p.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\4Pmmh3HlYKPz20b.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\5aFd8vA3PE3A.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\5F1yaAIKfUGQcmmt.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\5L9Wjn.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\5yqb2pxbZ.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\63sDzrkUoHoRT.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\66u5Ps.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\6aAIiUIf.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\6MR6.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\6SZfLTu9z.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\72oNcVyHs8NBv.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\6WMjwc1zqk3IB.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\7OxVHBv.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\7ZOfXpturAqbd1c.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\86iRpMfVS9o.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\8AuppwJ6wyt.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\8P9o.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\8Uu9ETpS.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\8xCKPsTPqAt0jj.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\9rNtWnjTq9RGbU.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\a3Ntx.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\A62zUUbY5QfVGXz.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\acZ9pR3WMOxAcq.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\aGAui.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\AL0XySsN7H7ugY.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\ar6cEZyyC.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\aXokYfum1LR9T.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\B2OE.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\b2v3n4eKoIDN.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\b6YuNbiDI.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\b9UD.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\BAa8xnBv7K.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Bcni29.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\BcZL4pkMX.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\bg3oTe.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\BK8vDj5a.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Bp9aBvvt.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\bvYkKJ33N9A.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\bwI55TdR2ltk57l.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\C04T72pR0Bcl.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\C3cps.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\caic.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\CEyeFINKwFDkgE0O.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\CflGlvefKCtC99t.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\CjIBD.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\CoCzQ91sOnv8.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\cTJXfHRYBCf7lK.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\czGQ8bl3v.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\d71boA.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\daTAwNa1cRBbYO.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\DgLGRP4C041.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\dgQJde60mPXhI.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\dH1rDN9f9.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\dskCEJ.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\DZ1I0FX.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\e8x938q.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\ecazG0z.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\EIy4cIf3Sw.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\EKeaJO.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Ery9w7qA.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\EvKbuCze.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\F07QalpWC.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\F3hzum1.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\fhjb3frndmupmzw.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\fkHEBb1SV.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\FksnKO3nPLqbqw.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\fnHklmDjE.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Frajmn2m7RI.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\FYmHKtcQNYS.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\G5IM1lDtK.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\G77JSgcmPf5H.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\gd7HlA2D90jF.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\gfoMPUZ1UQ.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\GgPR9V5hPE8bUpO.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\GiF6iC5.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\GnHuSl.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Go5opN9UMnRhwZ2o.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\gsHQMZi.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Haiz.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\HCCQmDcSMR.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\hKY8.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\hCmeX1Ct3FFL6dk.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\hlchPBL.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\HopLI4qUY5lj.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Hqee3DDn6LduWwwM.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\hsQjJvLaP.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Hyea.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\hZbsHrgo8ONOWmd.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\iEcMz.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\ieWzhDO3EIpCT.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\II5yrap9K.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\iLLOga.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\inloR0L.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\irQRC1fyB.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\iwIAg.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\IXWAmgM.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\J0j8.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Jdc9FtOxiP1gc.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\jDJAedKZ.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Jm34QKUSbOJ.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\JOq8Wlewlk.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\jU7uBI8eoGj.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\K6ok91lNINFU2.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\k9rCVCf.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\kdo6iAicsoicvHg.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\kDy3FUkn.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\kflWy2jLEiUoTUBN.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Kin7.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\klmqz.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\kY01UeAiy5.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\kYjkX0S1jo7Zm.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\kYSsy3IT.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\KYu5soC0W7AqbGh.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\lCEf83Wf7e4nuIMk.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\lcwvnk.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\LfRe1UstxS6dMj3.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\lg7Kv3Y5aqGhf94.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\lGzEUcaAA.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\lM74.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\M89doZVhROC.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\MCnPJFRa.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\MD5t.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\MElB1FKqC2cxb6AE.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Mfc8nmRBfzSVE.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\MqbmYiJCv9FZI.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\mj3KeUe3LBSMv2Dp.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\MRed6R.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\ms6h2c.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\mtgFs8Za.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\MZGXda99O.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\NhFS3OvQ4RI.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\NKqc2EyBDA.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\NOR3aMm.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\nptZgkCVl0OD.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\nWXR.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\o7AcVCKw0erZg.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\obSP1kkndHWX46p.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\ocNqp38QzZ.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\oDVNsk7OlJV.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\okbEY.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\OONBpjCfe.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\oyC5CL2.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\PpzHcsYvXs2l.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Q0JOBjRCtjVsC.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\q74MS.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Q7E9suq.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\qlDZYt.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\qMz8XR.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\quTGamas9Gw.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\qn6N701ce7yPWi2.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\QWfSLhRSIzwjS4.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\r5TP22jyIM.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\rbfKgDSibNA52.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\RByAvdjwTizpmk.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\RqpS.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\rRgk91Ih5n.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\RTgAfRGNR0qKZtig.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\RWbgv7OCA5wp.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\SakE.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Shs4s.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\siEjNwz.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\SLPSrgK9.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\snfLEUp5t.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Sw2EnkZnfpD.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\TcN5yBXi.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\TCyc7HRP97.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\tDUzYwYK5f.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Tmg2wsFHYf9ioO.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\TNZzXxx4kY1R7f7p.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\U8wBQmOOpsr.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\UG4UW.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\upb6mTYvIr.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\UyEm7.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\UylIt.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\uyvpJXmmwo8d.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\vHlVA6Ct.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\vUaM2EZYuiO.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\vY0SOrBhJvCg.jpg","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\vyi8eCg.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\w5JaoO.doc","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\wARff6exjpow.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\Wmih9mB0sDu.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\WUsiiJC2fRTBPivX.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\x41cViR8fbZW.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\XifskT.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\XjhA7gYLHhBHyEci.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\xl1sapqRRaB.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\xN1K.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\xqFng.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\xqjUvzokp0.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\XQO1VUYEm.pdf","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\XUPgjfK.rar","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\XXbWeI8CpUF.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\YGnYe5jfaKyuFM8.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\yFnr9fhc0gH7l.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\yZw6snqBQ28DAzu.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\ZCGDiOyLTL0HsH.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\zElI.mp3","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\ziJe5sSQm2.img","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\zlWDS7D.gif","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\zqpeyi.exe","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\zs7Ri62mzFGSx.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Downloads\\ZVaaZwpMDt.avi","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\163.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2345.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\355.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\System32\\en-US\\notepad.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\56.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Desktop\\Read Me.txt","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abcnews.go.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abril.com.br.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ameblo.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\americanexpress.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ask.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bing.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cartoonnetwork.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\comcast.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\comcast.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\commentcamarche.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\friv.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gmx.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\geocities.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\goo.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hao123.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imesh.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\in.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\inbox.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\indeed.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\joy.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\manta.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mediafire.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pandora.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\picnik.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pps.tv.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pptv.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\qiyi.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\rakuten.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sdo.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\seesaa.net.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\shopathome.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\softonic.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\sohu.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\southwest.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\telegraph.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\web.de.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\windowslivehelp.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\wn.com.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\xdwan.cn.url","sources":[{"report_type":"sandbox","report_id":"5c45a7b07ca3e1052c2d875b"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5c45a7b07ca3e1052c2d875b","5c45a7b17ca3e1052e28463f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Fragtor.Generic Sample eb00e3c45cb6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample eb00e3c45cb6…. Malware family: Fragtor.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138"}],["$","meta","4",{"property":"og:title","content":"Malicious Fragtor.Generic Sample eb00e3c45cb6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample eb00e3c45cb6…. Malware family: Fragtor.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/eb00e3c45cb698e44b087fd4646da69631ae88ba670d4d1507c7232040b10138"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Fragtor.Generic Sample eb00e3c45cb6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample eb00e3c45cb6…. Malware family: Fragtor.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]