26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f3c7a8dc8349… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f3c7a8dc8349…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba"],"about":{"@type":"SoftwareApplication","name":"Evil Locker.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T786,Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00010871-00004084) Spawned process "sc.exe" with commandline "sc delete "vmickvpexchange"" (UID: 00010873-00003236) Spawned process "sc.exe" with commandline "sc delete "vmicguestinterface"" (UID: 00010874-00002380) Spawned process "sc.exe" with commandline "sc delete "vmicheartbeat"" (UID: 00010876-00002284) Spawned process "sc.exe" with commandline "sc delete "vmicshutdown"" (UID: 00010876-00003912) Spawned process "sc.exe" with commandline "sc delete "vmicrdv"" (UID: 00010877-00003988) Spawned process "sc.exe" with commandline "sc delete "storflt"" (UID: 00010879-00004064) Spawned process "sc.exe" with commandline "sc delete "vmictimesync"" (UID: 00010879-00003332) Spawned process "sc.exe" with commandline "sc delete "vmicvss"" (UID: 00010881-00003696) Spawned process "sc.exe" with commandline "sc delete "MSSQLFDLauncher"" (UID: 00010882-00001188) Spawned process "sc.exe" with commandline "sc delete "MSSQLSERVER"" (UID: 00010883-00003168) Spawned process "sc.exe" with commandline "sc delete "SQLBrowser"" (UID: 00010884-00000656) Spawned process "sc.exe" with commandline "sc delete "SQLSERVERAGENT"" (UID: 00010884-00002000) Spawned process "sc.exe" with commandline "sc delete "SQLTELEMETRY"" (UID: 00010885-00003648) Spawned process "sc.exe" with commandline "sc delete "MsDtsServer130"" (UID: 00010886-00002856) Spawned process "sc.exe" with commandline "sc delete "SSISTELEMETRY130"" (UID: 00010887-00003228) Spawned process "sc.exe" with commandline "sc delete "SQLWriter"" (UID: 00010888-00001608) Spawned process "sc.exe" with commandline "sc delete "MSSQL$VEEAMSQL2012"" (UID: 00010889-00003884) Spawned process "sc.exe" with commandline "sc delete "SQLAgent$VEEAMSQL2012"" (UID: 00010890-00002796) Spawned process "sc.exe" with commandline "sc delete "SQLAgent"" (UID: 00010891-00003216)28:T786,Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00010871-00004084) Spawned process "sc.exe" with commandline "sc delete "vmickvpexchange"" (UID: 00010873-00003236) Spawned process "sc.exe" with commandline "sc delete "vmicguestinterface"" (UID: 00010874-00002380) Spawned process "sc.exe" with commandline "sc delete "vmicheartbeat"" (UID: 00010876-00002284) Spawned process "sc.exe" with commandline "sc delete "vmicshutdown"" (UID: 00010876-00003912) Spawned process "sc.exe" with commandline "sc delete "vmicrdv"" (UID: 00010877-00003988) Spawned process "sc.exe" with commandline "sc delete "storflt"" (UID: 00010879-00004064) Spawned process "sc.exe" with commandline "sc delete "vmictimesync"" (UID: 00010879-00003332) Spawned process "sc.exe" with commandline "sc delete "vmicvss"" (UID: 00010881-00003696) Spawned process "sc.exe" with commandline "sc delete "MSSQLFDLauncher"" (UID: 00010882-00001188) Spawned process "sc.exe" with commandline "sc delete "MSSQLSERVER"" (UID: 00010883-00003168) Spawned process "sc.exe" with commandline "sc delete "SQLBrowser"" (UID: 00010884-00000656) Spawned process "sc.exe" with commandline "sc delete "SQLSERVERAGENT"" (UID: 00010884-00002000) Spawned process "sc.exe" with commandline "sc delete "SQLTELEMETRY"" (UID: 00010885-00003648) Spawned process "sc.exe" with commandline "sc delete "MsDtsServer130"" (UID: 00010886-00002856) Spawned process "sc.exe" with commandline "sc delete "SSISTELEMETRY130"" (UID: 00010887-00003228) Spawned process "sc.exe" with commandline "sc delete "SQLWriter"" (UID: 00010888-00001608) Spawned process "sc.exe" with commandline "sc delete "MSSQL$VEEAMSQL2012"" (UID: 00010889-00003884) Spawned process "sc.exe" with commandline "sc delete "SQLAgent$VEEAMSQL2012"" (UID: 00010890-00002796) Spawned process "sc.exe" with commandline "sc delete "SQLAgent"" (UID: 00010891-00003216)29:T969,"EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ose.exe" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.xml" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi" with delete access "EvilLocker.exe" opened "C:\$Recycle.Bin\S-1-5-21-686412048-2446563785-1323799475-1001\desktop.ini" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\osetup.dll" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\PidGenX.dll" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ProPlusWW.msi" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ProPlusWW.xml" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ProPsWW.cab" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ProPsWW2.cab" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\setup.exe" with delete access "EvilLocker.exe" opened "C:\Program Files\7-Zip\Lang\ast.txt" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Setup.xml" with delete access "EvilLocker.exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab" with delete access2a:T1409,Spawned process "EvilLocker.exe" (UID: 00010791-00003472) Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00010871-00004084) Spawned process "sc.exe" with commandline "sc delete "vmickvpexchange"" (UID: 00010873-00003236) Spawned process "sc.exe" with commandline "sc delete "vmicguestinterface"" (UID: 00010874-00002380) Spawned process "sc.exe" with commandline "sc delete "vmicheartbeat"" (UID: 00010876-00002284) Spawned process "sc.exe" with commandline "sc delete "vmicshutdown"" (UID: 00010876-00003912) Spawned process "sc.exe" with commandline "sc delete "vmicrdv"" (UID: 00010877-00003988) Spawned process "sc.exe" with commandline "sc delete "storflt"" (UID: 00010879-00004064) Spawned process "sc.exe" with commandline "sc delete "vmictimesync"" (UID: 00010879-00003332) Spawned process "sc.exe" with commandline "sc delete "vmicvss"" (UID: 00010881-00003696) Spawned process "sc.exe" with commandline "sc delete "MSSQLFDLauncher"" (UID: 00010882-00001188) Spawned process "sc.exe" with commandline "sc delete "MSSQLSERVER"" (UID: 00010883-00003168) Spawned process "sc.exe" with commandline "sc delete "SQLBrowser"" (UID: 00010884-00000656) Spawned process "sc.exe" with commandline "sc delete "SQLSERVERAGENT"" (UID: 00010884-00002000) Spawned process "sc.exe" with commandline "sc delete "SQLTELEMETRY"" (UID: 00010885-00003648) Spawned process "sc.exe" with commandline "sc delete "MsDtsServer130"" (UID: 00010886-00002856) Spawned process "sc.exe" with commandline "sc delete "SSISTELEMETRY130"" (UID: 00010887-00003228) Spawned process "sc.exe" with commandline "sc delete "SQLWriter"" (UID: 00010888-00001608) Spawned process "sc.exe" with commandline "sc delete "MSSQL$VEEAMSQL2012"" (UID: 00010889-00003884) Spawned process "sc.exe" with commandline "sc delete "SQLAgent$VEEAMSQL2012"" (UID: 00010890-00002796) Spawned process "sc.exe" with commandline "sc delete "SQLAgent"" (UID: 00010891-00003216) Spawned process "sc.exe" with commandline "sc delete "MSSQL"" (UID: 00010891-00001596) Spawned process "sc.exe" with commandline "sc delete "MSSQLServerADHelper100"" (UID: 00010894-00004008) Spawned process "sc.exe" with commandline "sc delete "MSSQLServerOLAPService"" (UID: 00010895-00003536) Spawned process "sc.exe" with commandline "sc delete "MsDtsServer100"" (UID: 00010898-00003896) Spawned process "sc.exe" with commandline "sc delete "ReportServer"" (UID: 00010900-00003052) Spawned process "sc.exe" with commandline "sc delete "SQLTELEMETRY$HL"" (UID: 00010902-00003720) Spawned process "sc.exe" with commandline "sc delete "TMBMServer"" (UID: 00010902-00003248) Spawned process "sc.exe" with commandline "sc delete "MSSQL$PROGID"" (UID: 00010904-00001224) Spawned process "sc.exe" with commandline "sc delete "MSSQL$WOLTERSKLUWER"" (UID: 00010905-00003900) Spawned process "sc.exe" with commandline "sc delete "SQLAgent$PROGID"" (UID: 00010907-00003788) Spawned process "sc.exe" with commandline "sc delete "SQLAgent$WOLTERSKLUWER"" (UID: 00010914-00003276) Spawned process "sc.exe" with commandline "sc delete "MSSQLFDLauncher$OPTIMA"" (UID: 00010926-00003756) Spawned process "sc.exe" with commandline "sc delete "MSSQL$OPTIMA"" (UID: 00010928-00002664) Spawned process "sc.exe" with commandline "sc delete "SQLAgent$OPTIMA"" (UID: 00010931-00002404) Spawned process "sc.exe" with commandline "sc delete "ReportServer$OPTIMA"" (UID: 00010934-00003616) Spawned process "sc.exe" with commandline "sc delete "msftesql$SQLEXPRESS"" (UID: 00010936-00002684) Spawned process "sc.exe" with commandline "sc delete "postgresql-x64-9.4"" (UID: 00010938-00003400) Spawned process "sc.exe" with commandline "sc delete "WRSVC"" (UID: 00010973-00004040) Spawned process "sc.exe" with commandline "sc delete "KLIF"" (UID: 00010990-00003844) Spawned process "sc.exe" with commandline "sc delete "klpd"" (UID: 00010995-00003840) Spawned process "sc.exe" with commandline "sc delete "klflt"" (UID: 00010998-00001040) Spawned process "sc.exe" with commandline "sc delete "klbackupdisk"" (UID: 00011001-00003920) Spawned process "sc.exe" with commandline "sc delete "klbackupflt"" (UID: 00011003-00003972) Spawned process "sc.exe" with commandline "sc delete "klkbdflt"" (UID: 00011005-00002620) Spawned process "sc.exe" with commandline "sc delete "klmouflt""" (UID: 00011006-00002232), Spawned process "sc.exe" with commandline "sc delete "klhk"" (UID: 00011008-00002864), Spawned process "sc.exe" with commandline "sc delete "KSDE1.0.0"" (UID: 00011010-00002056), Spawned process "sc.exe" with commandline "sc delete "kltap"" (UID: 00011011-00001756), Spawned process "sc.exe" with commandline "sc delete "TmFilter"" (UID: 00011012-00001268), Spawned process "sc.exe" with commandline "sc delete "TMLWCSService"" (UID: 00011026-00001592), Spawned process "sc.exe" with commandline "sc delete "tmusa"" (UID: 00011032-00002256), Spawned process "sc.exe" with commandline "sc delete "TmPreFilter"" (UID: 00011034-00002284), Spawned process "sc.exe" with commandline "sc delete "TMSmartRelayService"" (UID: 00011041-00004004)2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791067470051,"unified_at":"2026-10-03T22:44:30.051Z","metadata":{"hashes":{"sha256":"f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba","sha1":"d747651b1a01e38da6f46289f9a9e0cc0c4f3135","md5":"54ef8e14e8e1dc5a047c546333e60658","sha512":"5bdc3ac4ae4aab90b61f87c204644fe72e5b4ebeb69e4deefbb73702d98a179ec6d32c4aff152fc542dc8599dda81b0de91910f06957ecda2945a60bf6070dd6","ssdeep":"6144:QUw22BgWYgeWYg955/155/HilquaOJydzFU:QUx8gWYgeWYg955/155/ClquaO","ssdeep_chunks":["6144:QUw22Bg","6144:Uw22BgW","6144:w22BgWY","6144:22BgWYg","6144:2BgWYge","6144:BgWYgeW","6144:gWYgeWY","6144:WYgeWYg","6144:YgeWYg9","6144:geWYg95","6144:eWYg955","6144:WYg955/","6144:Yg955/1","6144:g955/15","6144:955/155","6144:55/155/","6144:5/155/H","6144:/155/Hi","6144:155/Hil","6144:55/Hilq","6144:5/Hilqu","6144:/Hilqua","6144:HilquaO","6144:ilquaOJ","6144:lquaOJy","6144:quaOJyd","6144:uaOJydz","6144:aOJydzF","6144:OJydzFU","12288:QUw22Bg","12288:Uw22BgW","12288:w22BgWY","12288:22BgWYg","12288:2BgWYge","12288:BgWYgeW","12288:gWYgeWY","12288:WYgeWYg","12288:YgeWYg9","12288:geWYg95","12288:eWYg955","12288:WYg955/","12288:Yg955/1","12288:g955/15","12288:955/155","12288:55/155/","12288:5/155/H","12288:/155/Hi","12288:155/Hil","12288:55/Hilq","12288:5/Hilqu","12288:/Hilqua","12288:HilquaO","12288:ilquaOJ","12288:lquaOJy","12288:quaOJyd","12288:uaOJydz","12288:aOJydzF","12288:OJydzFU","6144:QUx8gWY","6144:Ux8gWYg","6144:x8gWYge","6144:8gWYgeW","6144:5/155/C","6144:/155/Cl","6144:155/Clq","6144:55/Clqu","6144:5/Clqua","6144:/ClquaO"],"imphash":"18dbcac273cfcbb96498828811671376"},"file_info":{"file_name":"Evil Locker.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":217088,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1531197832000,"last_seen":1649359771000,"last_multi_scan":1649359771000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["Evil","pemalform","ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":9,"suspicious_count":9,"malicious_count":7,"total":25},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.Filecoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1201777","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Everbe.0072E1A0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Everbe.0072E1A0 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win64/Filecoder.R trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/W64.LockFile.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.FileCrypter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0053734b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Everbe.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.dwa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.FileCoder.ffcoux","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.Evil.S3541952","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FBZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.EB6B1179","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.EB6B1179","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1063","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"WRSVC\" (Indicator: \"wrsvc\")","origin":"File/Memory","mitre_attack_id":"T1063","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vmicheartbeat\" (Indicator: \"vmicheartbeat\")\n \"vmicshutdown\" (Indicator: \"vmicshutdown\")\n \"vmicvss\" (Indicator: \"vmicvss\")\n \"sc delete \"vmicheartbeat\"\" (Indicator: \"vmicheartbeat\")\n \"sc delete \"vmicshutdown\"\" (Indicator: \"vmicshutdown\")\n \"sc delete \"vmicvss\"\" (Indicator: \"vmicvss\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"vssadmin.exe\" (UID: 00010871-00004084) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"vssadmin.exe\" (UID: 00010871-00004084) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$28","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"EvilLocker.exe\" touched file \"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb\"\n \"EvilLocker.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"EvilLocker.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"vssadmin.exe\" touched file \"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui\"\n \"vssadmin.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"vssadmin.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"sc.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"sc.exe\" touched file \"%WINDIR%\\System32\\en-US\\sc.exe.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://192.168.56.151:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56\"\n Pattern match: \"http://[fe80::8d8d:12f:f3a3:d4a9]:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"EvilLocker.exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"EvilLocker.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"EvilLocker.exe\" read file \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"EvilLocker.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\vssadmin.exe\", Handle: 112)\n \"EvilLocker.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\sc.exe\", Handle: 112)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"EvilLocker.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 4273909504)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\">>>>>>>>>>>>>>>>>>>>>>>>>>>> EVIL LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<< HELLO, DEAR FRIEND!1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ] Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the decryption program.2. [ HOW TO RECOVERY FILES? ] To receive the decryption program write on our e-mail: evil@cock.lu or evil@firemail.cc And in subject write your ID: ID-${CODE} We send you full instruction how to decrypt all your files.3. [ FREE DECRYPTION! ] Free decryption as guarantee. We guarantee the receipt of the decryption program after payment. To believe, you can give us up to 3 files that we decrypt for free. Files should not be important to you! (databases, backups, large excel sheets, etc.) >>>>>>>>>>>>>>>>>>>>>>>>>>>> EVIL LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<\" (Source: f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba.bin, Indicator: \"decrypt your files\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CryptEncrypt\n CreateToolhelp32Snapshot\n GetModuleFileNameW\n IsDebuggerPresent\n WinExec\n OpenProcess\n GetCommandLineW\n UnhandledExceptionFilter\n GetStartupInfoW\n GetProcAddress\n Process32FirstW\n Process32NextW\n FindNextFileW\n FindFirstFileW\n GetModuleHandleW\n TerminateProcess\n WriteFile\n CreateFileW\n Sleep\n GetFileSize\n ShellExecuteW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SleepConditionVariableCS\" (Source: f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba.bin, API is part of module: KERNEL32.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Opens many files with write access (often indicator for full-system infection)","description":"\"EvilLocker.exe\" opens more than 500 files with write access","origin":"API Call","relevance":10,"id":"api-49","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba.bin\" (Offset: 45224)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"28/67 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"28/67 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"EvilLocker.exe\" allocated memory in \"%PROGRAMFILES%\\","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"EvilLocker.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 112)\n \"EvilLocker.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 112)\n \"EvilLocker.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 112)\n \"EvilLocker.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 112)\n \"EvilLocker.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 112)\n \"EvilLocker.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\sc.exe\" (Handle: 112)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00010871-00004084)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2a","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]}]},"activity":{"stats":{"process_count":61,"spawned_processes_count":61,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":31,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":240,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["Evil","pemalform","ransomware"],"sample_flags":["User Comment"],"sandbox_reports":[{"id":"5b4439887ca3e155746fcbe4","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Ransom.Imps","submit_name":"Evil Locker.exe","analysis_start_time":"2018-07-10T05:40:48+00:00","indicators_count":{"informative":9,"suspicious":13,"malicious":9},"tags":["User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}],"processes":[{"pid":3472,"ppid":0,"name":"EvilLocker.exe","command_line":"","sha256":"f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba","normalized_path":"C:\\EvilLocker.exe","uid":"00010791-00003472","icon":"$2b"},{"pid":4084,"ppid":3472,"name":"vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00010791-00003472","uid":"00010871-00004084"},{"pid":3236,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"vmickvpexchange\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010873-00003236"},{"pid":2380,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"vmicguestinterface\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010874-00002380"},{"pid":2284,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"vmicheartbeat\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010876-00002284"},{"pid":3912,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"vmicshutdown\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010876-00003912"},{"pid":3988,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"vmicrdv\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010877-00003988"},{"pid":4064,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"storflt\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010879-00004064"},{"pid":3332,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"vmictimesync\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010879-00003332"},{"pid":3696,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"vmicvss\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010881-00003696"},{"pid":1188,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MSSQLFDLauncher\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010882-00001188"},{"pid":3168,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MSSQLSERVER\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010883-00003168"},{"pid":656,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SQLBrowser\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010884-00000656"},{"pid":2000,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SQLSERVERAGENT\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010884-00002000"},{"pid":3648,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SQLTELEMETRY\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010885-00003648"},{"pid":2856,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MsDtsServer130\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010886-00002856"},{"pid":3228,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SSISTELEMETRY130\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010887-00003228"},{"pid":1608,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SQLWriter\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010888-00001608"},{"pid":3884,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MSSQL$VEEAMSQL2012\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010889-00003884"},{"pid":2796,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SQLAgent$VEEAMSQL2012\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010890-00002796"},{"pid":3216,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SQLAgent\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010891-00003216"},{"pid":1596,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MSSQL\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010891-00001596"},{"pid":4008,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MSSQLServerADHelper100\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010894-00004008"},{"pid":3536,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MSSQLServerOLAPService\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010895-00003536"},{"pid":3896,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MsDtsServer100\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010898-00003896"},{"pid":3052,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"ReportServer\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010900-00003052"},{"pid":3720,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SQLTELEMETRY$HL\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010902-00003720"},{"pid":3248,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"TMBMServer\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010902-00003248"},{"pid":1224,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MSSQL$PROGID\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010904-00001224"},{"pid":3900,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MSSQL$WOLTERSKLUWER\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010905-00003900"},{"pid":3788,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SQLAgent$PROGID\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010907-00003788"},{"pid":3276,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SQLAgent$WOLTERSKLUWER\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010914-00003276"},{"pid":3756,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MSSQLFDLauncher$OPTIMA\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010926-00003756"},{"pid":2664,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"MSSQL$OPTIMA\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010928-00002664"},{"pid":2404,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"SQLAgent$OPTIMA\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010931-00002404"},{"pid":3616,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"ReportServer$OPTIMA\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010934-00003616"},{"pid":2684,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"msftesql$SQLEXPRESS\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010936-00002684"},{"pid":3400,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"postgresql-x64-9.4\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010938-00003400"},{"pid":4040,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"WRSVC\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010973-00004040"},{"pid":3844,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"KLIF\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010990-00003844"},{"pid":3840,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"klpd\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010995-00003840"},{"pid":1040,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"klflt\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00010998-00001040"},{"pid":3920,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"klbackupdisk\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011001-00003920"},{"pid":3972,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"klbackupflt\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011003-00003972"},{"pid":2620,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"klkbdflt\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011005-00002620"},{"pid":2232,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"klmouflt\"\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011006-00002232"},{"pid":2864,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"klhk\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011008-00002864"},{"pid":2056,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"KSDE1.0.0\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011010-00002056"},{"pid":1756,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"kltap\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011011-00001756"},{"pid":1268,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"TmFilter\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011012-00001268"},{"pid":1592,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"TMLWCSService\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011026-00001592"},{"pid":2256,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"tmusa\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011032-00002256"},{"pid":2284,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"TmPreFilter\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011034-00002284"},{"pid":4004,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"TMSmartRelayService\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011041-00004004"},{"pid":2824,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"VSApiNt\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011043-00002824"},{"pid":1688,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"TmCCSF\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011044-00001688"},{"pid":3604,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"tmlisten\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011045-00003604"},{"pid":3124,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"TmProxy\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011046-00003124"},{"pid":3580,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"ntrtscan\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011047-00003580"},{"pid":1996,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"ofcservice\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011048-00001996"},{"pid":3428,"ppid":3472,"name":"sc.exe","command_line":"sc delete \"UniFi\"","sha256":"eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00010791-00003472","uid":"00011049-00003428"}],"all_imported_dlls":["cryptbase.dll","vssapi.dll","rpcss.dll","advapi32.dll","shlwapi.dll","lpk.dll","gdi32.dll","cryptsp.dll","atl.dll","shell32.dll","oleaut32.dll","ntdll.dll","msvcrt.dll","rpcrt4.dll","apphelp.dll","imm32.dll","msctf.dll","clbcatq.dll","sechost.dll","user32.dll","usp10.dll","msasn1.dll","ole32.dll","vss_ps.dll","RpcRtRemote.dll","crypt32.dll","kernel32.dll","KernelBase.dll","rsaenh.dll","vsstrace.dll","mpr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%WINDIR%\\System32\\en-US\\sc.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\$Recycle.Bin\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\DESIGNER\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\All Users\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\MSOCache\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\PerfLogs\\Admin\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"C:\\PerfLogs\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7-zip32.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%PROGRAMFILES%\\7-Zip\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ClickToRun\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\Alphabet.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\Content.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ConvertInkStore.exe","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\boxed-join.avi","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\boxed-split.avi","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\correct.avi","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\delete.avi","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\join.avi","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\mip.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\split.avi","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\FlickAnimation.avi","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\FlickLearningWizard.exe","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrcommonlm.dat","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\HWRCustomization\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrenalm.dat","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrenclm.dat","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrlatinlm.dat","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwruklm.dat","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwruksh.dat","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrusalm.dat","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrusash.dat","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\InkDiv.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\InkObj.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\InkWatson.exe","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\InputPersonalization.exe","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscat.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipschs.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscht.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscsy.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsdan.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsdeu.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsen.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsesp.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\IPSEventLogMsg.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsfin.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsfra.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipshrv.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsita.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsjpn.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipskor.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsnld.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsnor.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsplk.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\IpsPlugin.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsptb.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsptg.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsrom.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsrus.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssrb.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssrl.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssve.xml","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\journal.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lv-LV\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\micaut.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\Microsoft.Ink.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\mip.exe","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\mraut.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\mshwgst.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\mshwLatin.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nb-NO\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nl-NL\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pl-PL\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-BR\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-PT\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ro-RO\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\rtscom.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ru-RU\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ShapeCollector.exe","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sk-SK\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sl-SI\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sr-Latn-CS\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sv-SE\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\TabIpsps.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tabskb.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\TabTip.exe","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\th-TH\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\TipBand.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\TipRes.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tipresx.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tipskins.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tiptsf.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tpcps.dll","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tr-TR\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\uk-UA\\!_HOW_RECOVERY_FILES_!.txt","sources":[{"report_type":"sandbox","report_id":"5b4439887ca3e155746fcbe4"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5b4439887ca3e155746fcbe4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample f3c7a8dc8349… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f3c7a8dc8349…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample f3c7a8dc8349… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f3c7a8dc8349…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f3c7a8dc83493b7257a705843ba350e171572666483de057f85f92da510f0eba"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample f3c7a8dc8349… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f3c7a8dc8349…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]