24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 201a9c5fe6a8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 201a9c5fe6a8…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9"],"about":{"@type":"SoftwareApplication","name":"Sony Breach Destover Malware.exe","applicationCategory":["peexe","executable"],"identifier":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8b4,"%WINDIR%\Temp\ams.exe" marked "C:\Windows\Temp\kph.sys" for deletion "C:\igfxtraysgi.exe" marked "C:\201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe" for deletion "C:\igfxtraysgi.exe" marked "C:\igfxtrayex.exe" for deletion "C:\igfxtraysgi.exe" marked "C:\igfxtraysgi.exe" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml" for deletion "C:\igfxtraysgi.exe" marked "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi" for deletion26:T8e5,"ams.exe" opened "C:\Windows\TEMP\kph.sys" with delete access "igfxtraysgi.exe" opened "C:\201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe" with delete access "igfxtraysgi.exe" opened "C:\igfxtrayex.exe" with delete access "igfxtraysgi.exe" opened "C:\igfxtraysgi.exe" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.msi" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordMUI.xml" with delete access "igfxtraysgi.exe" opened "C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.msi" with delete access27:Td7f,Spawned process ".exe" (UID: 00066387-00003432) Spawned process ".exe" with commandline "-i" (UID: 00066573-00003412) Spawned process ".exe" with commandline "-k" (UID: 00066751-00003404) Spawned process "igfxtrayex.exe" (UID: 00066908-00003224) Spawned process "igfxtrayex.exe" with commandline "-i" (UID: 00067103-00003720) Spawned process "igfxtrayex.exe" with commandline "-k" (UID: 00067291-00002740) Spawned process "igfxtraysqf.exe" with commandline "-a" (UID: 00068731-00002888) Spawned process "ams.exe" (UID: 00068897-00001612) Spawned process "igfxtraysie.exe" with commandline "-m" (UID: 00069057-00003312) Spawned process "igfxtraysgi.exe" with commandline "-d" (UID: 00069061-00003316) Spawned process "igfxtraysnq.exe" with commandline "-s" (UID: 00069068-00002580) Spawned process "igfxtrayex.exe" with commandline "-n" (UID: 00069126-00003604) Spawned process "cmd.exe" with commandline "/c net use \\SPE-CS2 "P@ssw0rd123" /u:"SPE\ADutta2-1" > 910118031_2572" (UID: 00069379-00001268) Spawned process "net.exe" with commandline "net use \\SPE-CS2 "P@ssw0rd123" /u:"SPE\ADutta2-1"" (UID: 00069421-00001972) Spawned process "cmd.exe" with commandline "/c net use \\la_data "P@ssw0rd123" /u:"SPE\ADutta2-1" > 910425578_2572" (UID: 00069862-00004008) Spawned process "net.exe" with commandline "net use \\la_data "P@ssw0rd123" /u:"SPE\ADutta2-1"" (UID: 00069872-00003876) Spawned process "cmd.exe" with commandline "/c net use \\SPE-SP3 "P@ssw0rd123" /u:"SPE\ADutta2-1" > 910428796_2572" (UID: 00070068-00002404) Spawned process "net.exe" with commandline "net use \\SPE-SP3 "P@ssw0rd123" /u:"SPE\ADutta2-1"" (UID: 00070076-00001140) Spawned process "cmd.exe" with commandline "/c net use "P@ssw0rd123" /u:"SPE\ADutta2-1" > 910434781_2572" (UID: 00070451-00001136) Spawned process "net.exe" with commandline "net use "P@ssw0rd123" /u:"SPE\ADutta2-1"" (UID: 00070457-00003276) Spawned process "cmd.exe" with commandline "/c net use "P@ssw0rd123" /u:"SPE\ADutta2-1" > 910435156_2572" (UID: 00070474-00003448) Spawned process "net.exe" with commandline "net use "P@ssw0rd123" /u:"SPE\ADutta2-1"" (UID: 00070480-00000304) Spawned process "cmd.exe" with commandline "/c net use "P@ssw0rd123" /u:"SPE\ADutta2-1" > 910435531_2572" (UID: 00070498-00003708) Spawned process "net.exe" with commandline "net use "P@ssw0rd123" /u:"SPE\ADutta2-1"" (UID: 00070503-00004028) Spawned process "cmd.exe" with commandline "/c net use "P@ssw0rd123" /u:"SPE\ADutta2-1" > 910435875_2572" (UID: 00070520-00001444) Spawned process "net.exe" with commandline "net use "P@ssw0rd123" /u:"SPE\ADutta2-1"" (UID: 00070525-00003532) Spawned process "cmd.exe" with commandline "/c net use "P@ssw0rd123" /u:"SPE\ADutta2-1" > 910436421_2572" (UID: 00070556-00003560) Spawned process "net.exe" with commandline "net use "P@ssw0rd123" /u:"SPE\ADutta2-1"" (UID: 00070562-00001336) Spawned process "cmd.exe" with commandline "/c net use \\SPE-SP1 "P@ssw0rd123" /u:"SPE\ADutta2-1" > 910436906_2572" (UID: 00070587-00001148) Spawned process "net.exe" with commandline "net use \\SPE-SP1 "P@ssw0rd123" /u:"SPE\ADutta2-1"" (UID: 00070591-00001180) Spawned process "cmd.exe" with commandline "/c net use "P@ssw0rd123" /u:"SPE\ADutta2-1" > 910442828_2572" (UID: 00070967-00003836) Spawned process "net.exe" with commandline "net use "P@ssw0rd123" /u:"SPE\ADutta2-1"" (UID: 00070972-00001828)28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790675216821,"unified_at":"2026-09-29T09:46:56.821Z","metadata":{"hashes":{"sha256":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9","sha1":"cb39c8639a2f74a3424d040d22a856859ab559a8","md5":"2618dd3e5c59ca851f03df12c0cab3b8","sha512":"6b5260917e2351df012b1b264129331977b2bb3203e98f33850563a0c9d338dd6bcb023e722b165ee22f4d3d565d8e372c7e14d60289f18bdb28a317dffc1d7a","ssdeep":"12288:aMts4GtTpnVsvL6wh9KRyJxUK5fJJiyQM9sTaDR9:ltsXtTNVDw9KirUytJDR9","ssdeep_chunks":["12288:aMts4Gt","12288:Mts4GtT","12288:ts4GtTp","12288:s4GtTpn","12288:4GtTpnV","12288:GtTpnVs","12288:tTpnVsv","12288:TpnVsvL","12288:pnVsvL6","12288:nVsvL6w","12288:VsvL6wh","12288:svL6wh9","12288:vL6wh9K","12288:L6wh9KR","12288:6wh9KRy","12288:wh9KRyJ","12288:h9KRyJx","12288:9KRyJxU","12288:KRyJxUK","12288:RyJxUK5","12288:yJxUK5f","12288:JxUK5fJ","12288:xUK5fJJ","12288:UK5fJJi","12288:K5fJJiy","12288:5fJJiyQ","12288:fJJiyQM","12288:JJiyQM9","12288:JiyQM9s","12288:iyQM9sT","12288:yQM9sTa","12288:QM9sTaD","12288:M9sTaDR","12288:9sTaDR9","24576:aMts4Gt","24576:Mts4GtT","24576:ts4GtTp","24576:s4GtTpn","24576:4GtTpnV","24576:GtTpnVs","24576:tTpnVsv","24576:TpnVsvL","24576:pnVsvL6","24576:nVsvL6w","24576:VsvL6wh","24576:svL6wh9","24576:vL6wh9K","24576:L6wh9KR","24576:6wh9KRy","24576:wh9KRyJ","24576:h9KRyJx","24576:9KRyJxU","24576:KRyJxUK","24576:RyJxUK5","24576:yJxUK5f","24576:JxUK5fJ","24576:xUK5fJJ","24576:UK5fJJi","24576:K5fJJiy","24576:5fJJiyQ","24576:fJJiyQM","24576:JJiyQM9","24576:JiyQM9s","24576:iyQM9sT","24576:yQM9sTa","24576:QM9sTaD","24576:M9sTaDR","24576:9sTaDR9","12288:ltsXtTN","12288:tsXtTNV","12288:sXtTNVD","12288:XtTNVDw","12288:tTNVDw9","12288:TNVDw9K","12288:NVDw9Ki","12288:VDw9Kir","12288:Dw9KirU","12288:w9KirUy","12288:9KirUyt","12288:KirUytJ","12288:irUytJD","12288:rUytJDR","12288:UytJDR9"],"imphash":"91e3769499c5b08d758dd79f47a349fc"},"file_info":{"file_name":"Sony Breach Destover Malware.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":440713,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499293859000,"last_seen":1676887595000,"last_multi_scan":1676887595000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["escad","gop","guardianofpeace","nukesped","operationtroy","silentchollima","targeted","whoisteam","gopwiper","apt","shamoon"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":16,"suspicious_count":20,"malicious_count":9,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.toWe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Dropper/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agentb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1219557","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jaik.66403","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-1388728","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.OOGA-3698","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jaik.66403 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/NukeSped.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Destover.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004b65791 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.bkob","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-Wiper","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.dnkqer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Destover-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agentb.440713","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_WIPALL.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_WIPALL.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.ALEB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agentb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agentb.Win32.6518","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Persistence","technique":"New Service","attack_id":"T1050","attack_id_wiki":"https://attack.mitre.org/techniques/T1050","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Execution","technique":"Command-Line Interface","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Process deletes itself"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Command and Control","technique":"Uncommonly Used Port","attack_id":"T1065","attack_id_wiki":"https://attack.mitre.org/techniques/T1065","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceA@ADVAPI32.DLL at 00017899-00003920-18940-5-00403270\n OpenServiceA@ADVAPI32.DLL at 00017899-00003920-25543-5-00403270\n OpenServiceA@ADVAPI32.DLL at 00018375-00003992-31771-5-00403270\n OpenServiceA@ADVAPI32.DLL at 00018375-00003992-37855-5-00403270","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"575961f4aac2ed8010b871dc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"575961f4aac2ed8010b871dc"},{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"575961f4aac2ed8010b871dc"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"212.31.102.100\"\n \"58.185.154.99\"\n \"200.87.126.116\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"575961f4aac2ed8010b871dc"},{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"cmd.exe /c wmic.exe /node:\"%s\" /user:\"%s\" /password:\"%s\" PROCESS CALL CREATE \"%s\" > %s\" (Indicator: \"wmic.exe\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"575961f4aac2ed8010b871dc"},{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateThread\n CreateProcessA\n WriteFile\n DeleteFileA\n GetFileSize\n GetModuleHandleA\n CreateFileA\n Sleep\n GetTickCount\n CopyFileA\n GetFileAttributesA\n GetModuleFileNameA\n GetStartupInfoA\n StartServiceA\n CreateServiceA\n StartServiceCtrlDispatcherA\n socket (Ordinal #23)\n connect (Ordinal #4)\n closesocket (Ordinal #3)\n WSAStartup (Ordinal #115)\n send (Ordinal #19)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"575961f4aac2ed8010b871dc"},{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"40532a7758582b77186a2b77653c2c770000000000bffb750000000056ccfb75000000007ccafb7500000000376867756a2c2c77d62d2c7700000000206967750000000029a6fb7500000000a48d677500000000f70efb7500000000\" to virtual address \"0x773E1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"575961f4aac2ed8010b871dc"},{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"49/57 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"575961f4aac2ed8010b871dc"},{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"49/57 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"575961f4aac2ed8010b871dc"},{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET SCAN Behavioral Unusual Port 445 traffic Potential Scan or Infection\" (SID: 2001569, Rev: 15, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET SCAN Behavioral Unusual Port 139 traffic Potential Scan or Infection\" (SID: 2001579, Rev: 15, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"43.148.49.27:445\"\n \"43.148.49.27:139\"\n \"14.97.13.43:445\"\n \"14.97.13.43:139\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \".exe\" (UID: 00064314-00002972) was launched with modified environment variables: \"Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"\n Process \".exe\" (UID: 00064314-00002972) was launched with missing environment variables: \"LOGONSERVER, HOMEPATH, HOMEDRIVE\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" with commandline \"-i\" (UID: 00064183-00003676)\n Spawned process \".exe\" with commandline \"-k\" (UID: 00064314-00002972)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \".exe\" with commandline \"-i\" (UID: 00064183-00003676)\n Spawned process \".exe\" with commandline \"-k\" (UID: 00064314-00002972)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"igfxtrayex.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"igfxtrayex.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.98851493287","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\".exe\" (Thread ID: 1256) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"igfxtrayex.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"58/72 Antivirus vendors marked dropped file \"igfxtrayex.exe\" as malicious (classified as \"Trojan.Destover\" with 80% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"54/69 Antivirus vendors marked spawned process \".exe\" (PID: 3676) as malicious (classified as \"Gen:Variant.Graftor\" with 78% detection rate)\n 54/69 Antivirus vendors marked spawned process \".exe\" (PID: 2972) as malicious (classified as \"Gen:Variant.Graftor\" with 78% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"C:\\201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe\" (Handle: 88)\n \".exe\" wrote 52 bytes to a remote process \"C:\\201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe\" (Handle: 88)\n \".exe\" wrote 4 bytes to a remote process \"C:\\201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe\" (Handle: 88)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"ams.exe\" (Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ZAWQ.BAT\")\n \"ams.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ZAWQ.BAT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"igfxtraysqf.exe\" created file \"%WINDIR%\\Temp\\ams.exe\"\n \"igfxtraysqf.exe\" created file \"%WINDIR%\\Temp\\kph.sys\"\n \"ams.exe\" created file \"%WINDIR%\\Temp\\zawq.bat\"\n \"igfxtraysie.exe\" created file \"%WINDIR%\\Temp\\usbdrv3.sys\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"ams.exe\" touched \"Computer\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"ams.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"ams.exe\" touched \"Security Manager\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c net use \\\\SPE-CS2 \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910118031_2572\" on 2020-11-24.03:02:26.976\n \"/c net use \\\\la_data \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910425578_2572\" on 2020-11-24.03:07:54.007\n \"/c net use \\\\SPE-SP3 \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910428796_2572\" on 2020-11-24.03:07:57.211\n \"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910434781_2572\" on 2020-11-24.03:08:03.164\n \"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910435156_2572\" on 2020-11-24.03:08:03.523\n \"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910435531_2572\" on 2020-11-24.03:08:03.882\n \"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910435875_2572\" on 2020-11-24.03:08:04.226\n \"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910436421_2572\" on 2020-11-24.03:08:04.789\n \"/c net use \\\\SPE-SP1 \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910436906_2572\" on 2020-11-24.03:08:05.273\n \"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910442828_2572\" on 2020-11-24.03:08:11.211","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"igfxtrayex.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"ams.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"C:\\igfxtraysgi.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"igfxtrayex.exe\" sleeping for \"02700000\" milliseconds\n \"igfxtrayex.exe\" sleeping for \"00300000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"C:\\201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe\", Handle: 116)\n \"igfxtrayex.exe\" is creating a new process (Name: \"C:\\igfxtrayex.exe\", Handle: 160)\n \"igfxtrayex.exe\" is creating a new process (Name: \"C:\\igfxtrayex.exe\", Handle: 348)\n \"igfxtrayex.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\audiodg.exe\", Handle: 228)\n \"igfxtrayex.exe\" is creating a new process (Name: \"C:\\igfxtraysie.exe\", Handle: 240)\n \"igfxtraysqf.exe\" is creating a new process (Name: \"%WINDIR%\\Temp\\ams.exe\", Handle: 192)\n \"ams.exe\" is creating a new process\n \"igfxtraysnq.exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\cmd.exe\", Handle: 200)\n \"cmd.exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\net.exe\", Handle: 140)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"ams.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 212.31.102.100 on port 8080 is sent without HTTP header\n TCP traffic to 58.185.154.99 on port 8080 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$25","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"ams.exe\" (Access type: \"DELETEVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"ams.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"igfxtraysqf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"igfxtraysie.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"igfxtraysgi.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"igfxtraysnq.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"igfxtrayex.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%WINDIR%\\SysWOW64\\nlaapi.dll\"\n \"igfxtrayex.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\"\n \"igfxtrayex.exe\" allocated memory in \"C:\\igfxtrayex.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 212.31.102.100 on port 8080\n TCP traffic to 200.87.126.116 on port 8000\n TCP traffic to 58.185.154.99 on port 8080","origin":"Network Traffic","mitre_attack_id":"T1065","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"ams.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$27","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"575961f4aac2ed8010b871dc"},{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]}]},"activity":{"stats":{"process_count":32,"spawned_processes_count":32,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":87,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":397,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":9,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["escad","gop","guardianofpeace","nukesped","operationtroy","silentchollima","targeted","whoisteam","gopwiper","apt","shamoon"],"sample_flags":["Sample not shared","Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"606e04b429c0730c7e338526","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor","contacted_countries":["IND","JPN"],"submit_name":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9","analysis_start_time":"2021-04-07T19:15:04+00:00","indicators_count":{"informative":9,"suspicious":11,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5fbc6c90a4c993585306d8ce","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":89,"malware_family":"Trojan.Agentb","contacted_countries":["BOL","CYP","JPN","SGP"],"submit_name":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe","analysis_start_time":"2020-11-24T02:14:42+00:00","indicators_count":{"informative":13,"suspicious":16,"malicious":10},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true},{"id":"575961f4aac2ed8010b871dc","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":95,"malware_family":"Gen:Variant.Graftor","submit_name":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.bin","analysis_start_time":"2016-06-09T14:33:31+00:00","indicators_count":{"informative":0,"suspicious":7,"malicious":3},"tags":["Sample not shared"],"is_in_unified_schema":true},{"id":"554fcd458690b87052ce40eb","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":92,"malware_family":"Gen:Variant.Graftor","submit_name":"Sony Breach Destover Malware.exe","analysis_start_time":"2015-05-10T23:27:42+00:00","indicators_count":{"informative":0,"suspicious":5,"malicious":2},"tags":["Sample not shared"],"is_in_unified_schema":true},{"id":"554fc6b18690b8b64d440a6b","environment_id":1,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":92,"malware_family":"Gen:Variant.Graftor","submit_name":"Sony Breach Destover Malware.exe","analysis_start_time":"2015-05-10T23:00:21+00:00","indicators_count":{"informative":0,"suspicious":3,"malicious":2},"tags":["Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"43.148.49.27","port":445,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"address":"43.148.49.27","port":139,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"address":"14.97.13.43","port":445,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"address":"14.97.13.43","port":139,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]},{"address":"212.31.102.100","port":8080,"protocol":"TCP","country":"Cyprus","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"address":"200.87.126.116","port":8000,"protocol":"TCP","country":"Bolivia","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"address":"58.185.154.99","port":8080,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"address":"43.148.49.120","port":445,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"address":"43.148.49.120","port":139,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}],"processes":[{"pid":3432,"ppid":0,"name":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe","command_line":"","sha256":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9","normalized_path":"C:\\201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe","uid":"00066387-00003432","icon":"$28"},{"pid":3412,"ppid":3432,"name":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe","command_line":"-i","sha256":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9","normalized_path":"C:\\201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe","parent_uid":"00066387-00003432","uid":"00066573-00003412"},{"pid":3404,"ppid":0,"name":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe","command_line":"-k","sha256":"201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9","normalized_path":"C:\\201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe","uid":"00066751-00003404","icon":"$29"},{"pid":3224,"ppid":3404,"name":"igfxtrayex.exe","command_line":"","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","normalized_path":"C:\\igfxtrayex.exe","parent_uid":"00066751-00003404","uid":"00066908-00003224"},{"pid":3720,"ppid":3224,"name":"igfxtrayex.exe","command_line":"-i","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","normalized_path":"C:\\igfxtrayex.exe","parent_uid":"00066908-00003224","uid":"00067103-00003720"},{"pid":2740,"ppid":0,"name":"igfxtrayex.exe","command_line":"-k","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","normalized_path":"C:\\igfxtrayex.exe","uid":"00067291-00002740","icon":"$2a"},{"pid":2888,"ppid":2740,"name":"igfxtraysqf.exe","command_line":"-a","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","normalized_path":"C:\\igfxtraysqf.exe","parent_uid":"00067291-00002740","uid":"00068731-00002888"},{"pid":1612,"ppid":2888,"name":"ams.exe","command_line":"","sha256":"a2c03feaf06282b432ad7898a64cf095d771e122c84bb62fb9cf8548fac2ebab","normalized_path":"%WINDIR%\\Temp\\ams.exe","parent_uid":"00068731-00002888","uid":"00068897-00001612"},{"pid":3312,"ppid":2740,"name":"igfxtraysie.exe","command_line":"-m","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","normalized_path":"C:\\igfxtraysie.exe","parent_uid":"00067291-00002740","uid":"00069057-00003312"},{"pid":3316,"ppid":2740,"name":"igfxtraysgi.exe","command_line":"-d","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","normalized_path":"C:\\igfxtraysgi.exe","parent_uid":"00067291-00002740","uid":"00069061-00003316"},{"pid":2580,"ppid":2740,"name":"igfxtraysnq.exe","command_line":"-s","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","normalized_path":"C:\\igfxtraysnq.exe","parent_uid":"00067291-00002740","uid":"00069068-00002580"},{"pid":1268,"ppid":2580,"name":"cmd.exe","command_line":"/c net use \\\\SPE-CS2 \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910118031_2572","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00069068-00002580","uid":"00069379-00001268"},{"pid":1972,"ppid":1268,"name":"net.exe","command_line":"net use \\\\SPE-CS2 \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00069379-00001268","uid":"00069421-00001972"},{"pid":4008,"ppid":2580,"name":"cmd.exe","command_line":"/c net use \\\\la_data \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910425578_2572","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00069068-00002580","uid":"00069862-00004008"},{"pid":3876,"ppid":4008,"name":"net.exe","command_line":"net use \\\\la_data \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00069862-00004008","uid":"00069872-00003876"},{"pid":2404,"ppid":2580,"name":"cmd.exe","command_line":"/c net use \\\\SPE-SP3 \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910428796_2572","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00069068-00002580","uid":"00070068-00002404"},{"pid":1140,"ppid":2404,"name":"net.exe","command_line":"net use \\\\SPE-SP3 \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00070068-00002404","uid":"00070076-00001140"},{"pid":1136,"ppid":2580,"name":"cmd.exe","command_line":"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910434781_2572","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00069068-00002580","uid":"00070451-00001136"},{"pid":3276,"ppid":1136,"name":"net.exe","command_line":"net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00070451-00001136","uid":"00070457-00003276"},{"pid":3448,"ppid":2580,"name":"cmd.exe","command_line":"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910435156_2572","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00069068-00002580","uid":"00070474-00003448"},{"pid":304,"ppid":3448,"name":"net.exe","command_line":"net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00070474-00003448","uid":"00070480-00000304"},{"pid":3708,"ppid":2580,"name":"cmd.exe","command_line":"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910435531_2572","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00069068-00002580","uid":"00070498-00003708"},{"pid":4028,"ppid":3708,"name":"net.exe","command_line":"net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00070498-00003708","uid":"00070503-00004028"},{"pid":1444,"ppid":2580,"name":"cmd.exe","command_line":"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910435875_2572","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00069068-00002580","uid":"00070520-00001444"},{"pid":3532,"ppid":1444,"name":"net.exe","command_line":"net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00070520-00001444","uid":"00070525-00003532"},{"pid":3560,"ppid":2580,"name":"cmd.exe","command_line":"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910436421_2572","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00069068-00002580","uid":"00070556-00003560"},{"pid":1336,"ppid":3560,"name":"net.exe","command_line":"net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00070556-00003560","uid":"00070562-00001336"},{"pid":1148,"ppid":2580,"name":"cmd.exe","command_line":"/c net use \\\\SPE-SP1 \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910436906_2572","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00069068-00002580","uid":"00070587-00001148"},{"pid":1180,"ppid":1148,"name":"net.exe","command_line":"net use \\\\SPE-SP1 \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00070587-00001148","uid":"00070591-00001180"},{"pid":3836,"ppid":2580,"name":"cmd.exe","command_line":"/c net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\" > 910442828_2572","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00069068-00002580","uid":"00070967-00003836"},{"pid":1828,"ppid":3836,"name":"net.exe","command_line":"net use \"P@ssw0rd123\" /u:\"SPE\\ADutta2-1\"","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00070967-00003836","uid":"00070972-00001828"},{"pid":3604,"ppid":2740,"name":"igfxtrayex.exe","command_line":"-n","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","normalized_path":"C:\\igfxtrayex.exe","parent_uid":"00067291-00002740","uid":"00069126-00003604"}],"all_imported_dlls":["kernel32.dll","gdi32.dll","usp10.dll","imm32.dll","msctf.dll","KernelBase.dll","shlwapi.dll","apphelp.dll","mpr.dll","nsi.dll","user32.dll","lpk.dll","advapi32.dll","sechost.dll","msvcrt.dll","rpcrt4.dll","ws2_32.dll","ntdll.dll","NapiNSP.dll","IPHLPAPI.DLL","dnsapi.dll","winnsi.dll","rasadhlp.dll","nlaapi.dll","pnrpnsp.dll","mswsock.dll","winrnr.dll","WSHTCPIP.DLL","wow64.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","devobj.dll","cscapi.dll","wship6.dll","wow64win.dll","api-ms-win-core-synch-l1-2-0.dll","browcli.dll","cryptsp.dll","dhcpcsvc6.dll","shell32.dll","oleaut32.dll","urlmon.dll","normaliz.dll","credssp.dll","profapi.dll","davclnt.dll","uxtheme.dll","dwmapi.dll","wow64cpu.dll","sspicli.dll","winsta.dll","cryptbase.dll","ole32.dll","wtsapi32.dll","webio.dll","IconCodecService.dll","userenv.dll","WlS0WndH.dll","netmsg.dll","drprov.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","winbrand.dll","davhlpr.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","dhcpcsvc.dll","clbcatq.dll","setupapi.dll","WindowsCodecs.dll","srvcli.dll","samcli.dll","netapi32.dll","propsys.dll","version.dll","FWPUCLNT.DLL","wkscli.dll","wininet.dll","secur32.dll","comctl32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","iertutil.dll","winhttp.dll","netutils.dll","VxSSL64.dll","cfgmgr32.dll","ntlanman.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"igfxtrayex.exe","sha256":"0753f8a7ae38fdb830484d0d737f975884499b9335e70b7d22b7d4ab149c01b5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9.exe","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\igfxtrayex.exe","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\910435531_2572","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\910435875_2572","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\910436421_2572","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\910435156_2572","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\910434781_2572","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\910428796_2572","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\910425578_2572","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\910118031_2572","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\Temp\\ams.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\Temp\\usbdrv3.sys","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\igfxtraysgi.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\igfxtraysie.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\Office32WW.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\Office32WW.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\ose.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\osetup.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\PidGenX.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\StdrWW.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7-zip.chm","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7-zip.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7-zip32.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7z.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7z.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7z.sfx","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7zCon.sfx","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7zFM.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7zG.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\descript.ion","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\History.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\af.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\an.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ar.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\az.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ba.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\be.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bg.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bn.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\br.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ca.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\co.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cs.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cy.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\da.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\de.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\el.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\en.ttt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\es.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\et.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eu.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ext.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fa.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fi.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fr.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fur.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fy.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ga.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gl.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gu.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\he.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hi.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hr.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hu.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hy.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\id.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\io.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\is.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\it.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ja.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ka.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kaa.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kk.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ko.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku-ckb.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ky.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lij.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lt.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lv.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mk.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mn.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng2.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mr.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ms.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nb.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pl.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ps.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt-br.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ro.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ru.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sa.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\si.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sk.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sq.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spc.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spl.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sv.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ta.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tr.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tt.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ug.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uk.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uz.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\va.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\vi.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\yo.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-cn.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-tw.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\readme.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Uninstall.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW\\DBGHELP.DLL","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW\\DW20.EXE","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW\\DWTRIG20.EXE","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO\\MSOEURO.DLL","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters\\msgfilt.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters\\odffilt.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters\\offfiltx.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\MS.CGM","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\MS.GIF","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\MS.JPG","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\MS.PNG","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\MS.WPG","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\PNG32.FLT","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help\\msitss55.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\Content.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ConvertInkStore.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\boxed-join.avi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\boxed-split.avi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\correct.avi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\delete.avi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\FlickAnimation.avi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\FlickLearningWizard.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrcommonlm.dat","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrenalm.dat","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrenclm.dat","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrlatinlm.dat","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrusash.dat","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\InkDiv.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\InkObj.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\InkWatson.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\InputPersonalization.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscat.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipschs.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscht.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipscsy.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsdan.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsdeu.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\micaut.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\Microsoft.Ink.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\mip.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\mraut.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\mshwgst.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\mshwLatin.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ShapeCollector.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\TabIpsps.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tabskb.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\TipRes.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tipresx.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tipskins.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tiptsf.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tpcps.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\walls.bmp","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\910436906_2572","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"\\.\\.","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\910442828_2572","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\net.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\Temp\\zawq.bat","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\Temp\\kph.sys","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\igfxtraysnq.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\igfxtraysqf.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\setup.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\StandardrWW.msi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0012-0000-1000-0000000FF1CE}-C\\StandardrWW.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ast.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eo.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ne.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nl.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nn.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pa-in.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sl.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\th.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%PROGRAMFILES%\\7-Zip\\License.txt","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\DESIGNER\\MSADDNDR.DLL","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\MS.EPS","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help\\hxds.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help\\ITIRCL55.DLL","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\Alphabet.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\join.avi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\mip.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\split.avi","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwruklm.dat","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwruksh.dat","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hwrusalm.dat","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsen.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsesp.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\IPSEventLogMsg.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsfin.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsfra.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipshrv.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsita.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsjpn.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipskor.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsnld.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsnor.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsplk.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\IpsPlugin.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsptb.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsptg.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsrom.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipsrus.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssrb.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssrl.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ipssve.xml","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\journal.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\rtscom.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\TabTip.exe","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\TipBand.dll","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"606e04b429c0730c7e338526"},{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fbc6c90a4c993585306d8ce"}]}]}},"report_ids":{"sandbox_job_ids":["606e04b429c0730c7e338526","575961f4aac2ed8010b871dc","554fcd458690b87052ce40eb","554fc6b18690b8b64d440a6b","5fbc6c90a4c993585306d8ce"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 201a9c5fe6a8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 201a9c5fe6a8…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 201a9c5fe6a8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 201a9c5fe6a8…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/201a9c5fe6a8ae0d1c4312d07ef2066e5991b1462b68f102154bb9cb25bf59f9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 201a9c5fe6a8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 201a9c5fe6a8…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]